by Kastro
Paper/Archive/CVE-2023-41149

CVE-2023-41149

Thinkingreed Inc. F-RevoCRM — F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.2.742 × 2014.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.

Affected

ProductAffectedFixed inSource
F-RevoCRMversion7.3.7 and version7.3.8 –CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reff-revocrm.jp/2023/08/9394refjvn.jp/en/jp/JVN78113802