PT-2023-21179 · Unknown · Microengine Mailform

三井物産セキュアディレクション株式会社 東内 裕二 氏 + 1 · Published 2023-05-23 · Updated 2025-01-31 · CVE-2023-27507

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroEngine Mailform versions 1.1.0 through 1.1.8

Description The issue allows a remote attacker to save an arbitrary file on the server and execute it, given that the file upload function and server save option are enabled. This is due to a path traversal vulnerability.

Recommendations For versions 1.1.0 through 1.1.8, consider disabling the file upload function and server save option as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-27507

Affected Products

Microengine Mailform

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-27507 · Security Note
• https://microengine.jp/information/security_2023_05.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27507 · Vendor Advisory
• https://t.me/cibsecurity/64601 · Telegram Post
• https://jvn.jp/en/jp/JVN31701509 · Note
• https://t.me/cvenotify/51372 · Telegram Post
• https://t.me/cvenotify/109414 · Telegram Post