Vulnerability · Published Jun 12, 2023 · Assigned by mitre
CVE-2023-33253
High 8.8
In plain English
A high-severity security flaw in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.5%top 15.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file (such as shell.jpg.php.shell) being sent.