Paper/Archive/CVE-2023-34207

CVE-2023-34207

EasyUse Digital Technology MailHunter Ultimate — Unrestricted Upload of File with Dangerous Type in EasyUse MailHunter Ultimate

EPSS 0.9%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 58.6.586 × 2011.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive.

Affected

ProductAffectedFixed inSource

MailHunter Ultimate≤ 2023–CNA

Scores by source

ZUSO ART (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupzuso.ai/Advisory/ZA-2023-04