PT-2024-14038 · Stud.Ip · Stud.Ip

Rene Rehme · Published 2024-01-08 · Updated 2024-01-12 · CVE-2023-50982

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stud.IP versions 5.x through 5.3.3

Description The issue allows XSS with resultant upload of executable files because upload action and edit action in Admin SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user.

Recommendations For versions 5.0.x, update to version 5.0.9. For versions 5.1.x, update to version 5.1.7. For versions 5.2.x, update to version 5.2.6. For versions 5.3.x, update to version 5.3.4. As a temporary workaround, consider disabling the upload action and edit action functions in Admin SmileysController until a patch is available. Restrict access to the Admin SmileysController to minimize the risk of exploitation.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2023-50982

Affected Products

Stud.Ip

References · 9

• 🔥 https://rehmeinfosec.de/labor/cve-2023-50982 · Exploit
• https://osv.dev/vulnerability/CVE-2023-50982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50982 · Security Note
• https://twitter.com/CVEnew/status/1744453229298192517 · Twitter Post
• https://sourceforge.net/projects/studip/files/Stud.IP/5.4 · Note
• https://twitter.com/VulmonFeeds/status/1744473493582774362 · Twitter Post
• https://gitlab.studip.de/studip/studip/-/tags · Note
• https://t.me/cvenotify/66731 · Telegram Post
• https://t.me/cvenotify/66673 · Telegram Post