PT-2023-3469 · Unknown · Omicard Edm+1

曾國韋 · Published 2023-05-30 · Updated 2023-06-09 · CVE-2023-28700

Positive Technologies · (AI Summary)

CVSS v2.0

7.7

High

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OMICARD EDM ITPison (affected versions not specified) OMICARD EDM (affected versions not specified)

Description The issue is related to the file uploading function in the OMICARD EDM backend system, which does not restrict the upload of files with dangerous types. This can be exploited by an attacker, potentially remotely or with administrator privileges on a local area network, to upload and run arbitrary executable files. This exploitation could allow the attacker to perform arbitrary system commands or disrupt the service.

Recommendations For OMICARD EDM ITPison, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For OMICARD EDM, consider restricting access to the file uploading function until a patch is available, and ensure that only authorized personnel with the necessary privileges can upload files to minimize the risk of exploitation.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-03655

CVE-2023-28700

Affected Products

Omicard Edm

Itpison Omicard Edm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-28700 · Security Note
• https://bdu.fstec.ru/vul/2023-03655 · Security Note
• https://t.me/cvenotify/51615 · Telegram Post
• https://twcert.org.tw/tw/cp-132-7144-b7536-1.html · Note