PT-2023-26497 · Openrapid · Openrapid Rapidcms

Txph · Publicado 2023-07-23 · Atualizado 2024-09-21 · CVE-2023-3852

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenRapid RapidCMS versions up to 1.3.1

Description A critical issue affects the file /admin/upload.php, where the manipulation of the file argument leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch with the name 4dff387283060961c362d50105ff8da8ea40bcbe. As a temporary workaround, consider restricting access to the /admin/upload.php file until the patch is applied. Avoid using the file argument in the affected file until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-3852

Produtos afetados

Openrapid Rapidcms

Referências · 9

• 🔥 https://github.com/OpenRapid/rapidcms/issues/1 · Exploit
• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbe · Correção
• https://osv.dev/vulnerability/CVE-2023-3852 · Aviso do Fabricante
• https://twitter.com/rst_cloud/status/1837592534853263790 · Publicação no Twitter
• https://vuldb.com/?id.235204 · Nota
• https://t.me/cvenotify/54984 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3852 · Nota de Segurança
• https://vuldb.com/?ctiid.235204 · Nota
• https://t.me/cibsecurity/67131 · Publicação no Telegram