PT-2023-15226 · Unknown · Generex Cs141

Published 2023-09-28 · Updated 2023-10-03 · CVE-2022-47186

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Generex CS141 versions prior to 2.06

Description The issue allows for an unrestricted upload of files, enabling an attacker to upload and/or delete any type of file without format restrictions or authentication in the "upload" directory. This vulnerability also facilitates a file upload XSS attack, where an attacker can upload a file containing HTML content, potentially leading to cross-site scripting.

Recommendations For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the "upload" directory to minimize the risk of exploitation. Avoid using the file upload feature in the affected versions until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-47186

Affected Products

Generex Cs141

References · 6

• https://osv.dev/vulnerability/CVE-2022-47186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47186 · Security Note
• https://generex.de/support/changelogs/cs141/page:2 · Note
• https://twitter.com/CVEnew/status/1707389419412455773 · Twitter Post
• https://twitter.com/DMFezzaReedCISA/status/1707432134573470070 · Twitter Post
• https://incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 · Note