PT-2023-23379 · Unknown · Ckeditor Plugin For Redmine

CVE-2023-31541 · Publicado 2023-06-13 · Atualizado 2025-01-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CKEditor plugin for Redmine version 1.2.3

Description A vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor plugin for Redmine, allowing arbitrary files to be uploaded to the server. This issue affects the ability to restrict file uploads, potentially leading to security risks.

Recommendations For version 1.2.3, consider disabling the ‘Browse and upload images’ feature until a patch is available to prevent arbitrary file uploads. Restrict access to the upload functionality to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-31541

Produtos afetados

Ckeditor Plugin For Redmine

Referências · 9

• 🔥 https://github.com/DreamD2v/CVE-2023-31541 · Exploit
• 🔥 https://github.com/DreamD2v/CVE-2023-31541/blob/main/CVE-2023-31541.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-31541 · Aviso do Fabricante
• http://redmine.com · Nota
• http://redmineckeditor.com · Nota
• https://t.me/cvenotify/52211 · Publicação no Telegram
• https://t.me/cvenotify/106249 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31541 · Nota de Segurança
• https://t.me/cvenotify/52887 · Publicação no Telegram