PT-2023-20720 · European Chemicals Agency · Iuclid

Published 2023-05-02 · Updated 2025-01-30 · CVE-2023-26546

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions European Chemicals Agency IUCLID versions prior to 6.27.6

Description The issue allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a crafted template file. The attacker must have template manager permission.

Recommendations For versions prior to 6.27.6, update to version 6.27.6 or later to resolve the issue. As a temporary workaround, consider restricting template manager permissions to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-26546

Affected Products

Iuclid

References · 7

• https://osv.dev/vulnerability/CVE-2023-26546 · Vendor Advisory
• https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26546 · Security Note
• https://iuclid6.echa.europa.eu/download · Note
• https://t.me/cibsecurity/63181 · Telegram Post
• https://iuclid6.echa.europa.eu · Note
• https://t.me/cvenotify/109228 · Telegram Post