PT-2023-18754 · Smartbear · Smartbear Zephyr Enterprise

Publicado 2023-03-08 · Atualizado 2025-03-05 · CVE-2023-22890

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SmartBear Zephyr Enterprise versions through 7.15.0

Description The issue allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition.

Recommendations For SmartBear Zephyr Enterprise versions through 7.15.0, restrict access to file upload functionality to prevent unauthenticated users from uploading large files until a patch is available. Consider implementing size limits on file uploads as a temporary mitigation measure.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-22890

Produtos afetados

Smartbear Zephyr Enterprise

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-22890 · Aviso do Fabricante
• https://smartbear.com/security/cve · Aviso do Fabricante
• https://t.me/cvenotify/113563 · Publicação no Telegram
• https://t.me/cvenotify/45828 · Publicação no Telegram
• https://t.me/cvenotify/46162 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22890 · Nota de Segurança
• https://t.me/cibsecurity/59709 · Publicação no Telegram