Critical severity · published Jul 20, 2023
CVE-2023-37289
InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Document On-line Submission and Approval System · InfoDoc
22547; 22567 · source: vendor, NVD
Affected product
DO
Document On-line Submission and Approval System
InfoDoc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37289
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7225-cef32-1.html
More from Document On-line Submission and Approval System
7.5
CVE-2023-37290
InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF)