PT-2023-28016 · Grupposcai · Realgimm

Claudio Rimensi + 2 · Publicado 2023-08-31 · Atualizado 2023-09-06 · CVE-2023-41637

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GruppoSCAI RealGimm version 1.1.37p38

Description The issue allows attackers to execute arbitrary code via uploading a crafted HTML file, exploiting an arbitrary file upload vulnerability in the Carica immagine function.

Recommendations For GruppoSCAI RealGimm version 1.1.37p38, consider restricting access to the Carica immagine function to minimize the risk of exploitation until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-41637

Produtos afetados

Realgimm

Referências · 5

• 🔥 https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41637%20%7C%20RealGimm%20-%20Stored%20Cross-site%20Scripting.md · Exploit
• 🔥 https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20Stored%20Cross-site%20Scripting.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-41637 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-41637 · Nota de Segurança
• https://t.me/cibsecurity/69551 · Publicação no Telegram