Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-37289: 英福達科技 電子公文系統 - Arbitrary File Upload

It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker to exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567.

CVE
#vulnerability#auth

:::

  • 首頁
  • 資安服務
  • 台灣漏洞揭露平台 (TVN)
  • TVN (Taiwan Vulnerability Note) 漏洞公告

TVN ID

TVN-202307007

CVE ID

CVE-2023-37289

CVSS

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

影響產品

電子公文系統版本22547、22567

問題描述

英福達科技之電子公文系統上傳功能未對上傳檔案進行檢查限制,導致不須登入的遠端攻擊者可以上傳任意檔案,進而執行任意程式碼或中斷系統服務。

解決方法

請聯繫英福達科技詢問相關修補建議

漏洞通報者

Huding (DEVCORE)

公開日期

2023-07-17

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda