PT-2023-24472 · Unisign · Bookreen

Anil Celik · Publicado 2023-09-05 · Atualizado 2026-05-22 · CVE-2023-3375

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bookreen versions prior to 3.0.0

Description The issue affects Unisign Bookreen, allowing OS Command Injection due to an Unrestricted Upload of File with Dangerous Type vulnerability.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to prevent potential OS Command Injection attacks.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-3375

Produtos afetados

Bookreen

Referências · 9

• https://t.me/cibsecurity/69869 · Publicação no Telegram
• https://t.me/cveNotify/164531 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1699103448535556188 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-3375 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1699301496440132016 · Publicação no Twitter
• https://usom.gov.tr/bildirim/tr-23-0489 · Nota
• https://t.me/cvenotify/57809 · Publicação no Telegram
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0489 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3375 · Nota de Segurança