Paper/Archive/CVE-2023-32753

CVE-2023-32753

ITPison Contact ITPison — ITPison OMICARD EDM - Arbitrary File Upload

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 60.6.606 × 2012.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.

Affected

ProductAffectedFixed inSource

Contact ITPisonsee advisory–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftwcert.org.tw/en/cp-139-7190-d73c1-2.html