by Kastro
Paper/Archive/CVE-2023-48390

CVE-2023-48390

Multisuns EasyLog web+ — Multisuns EasyLog web+ - Command Injection

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.1.661 × 2013.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service.

Affected

ProductAffectedFixed inSource
EasyLog web+1.13.2.8–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-7605-2d86d-1.html