by Kastro
Paper/Archive/CVE-2023-50090

CVE-2023-50090

mitre — Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files an…

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.7.557 × 2011.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reflemono.fun/thoughts/UReport2-RCE.html