PT-2023-21179 · Unknown · Microengine Mailform

三井物産セキュアディレクション株式会社 東内 裕二 氏 + 1 · Publicado 2023-05-23 · Atualizado 2025-01-31 · CVE-2023-27507

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroEngine Mailform versions 1.1.0 through 1.1.8

Description The issue allows a remote attacker to save an arbitrary file on the server and execute it, given that the file upload function and server save option are enabled. This is due to a path traversal vulnerability.

Recommendations For versions 1.1.0 through 1.1.8, consider disabling the file upload function and server save option as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-27507

Produtos afetados

Microengine Mailform

Referências · 7

• https://t.me/cibsecurity/64601 · Publicação no Telegram
• https://jvn.jp/en/jp/JVN31701509 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-27507 · Nota de Segurança
• https://t.me/cvenotify/51372 · Publicação no Telegram
• https://microengine.jp/information/security_2023_05.html · Aviso do Fabricante
• https://t.me/cvenotify/109414 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27507 · Aviso do Fabricante