Vulnerability · Published Nov 3, 2023 · Assigned by twcert
CVE-2023-41357Galaxy Software Services Vitals ESP - Arbitrary File Upload
High 8.8
In plain English
A high-severity unrestricted file upload in Vitals ESP from Galaxy Software Services. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Galaxy Software Services | Vitals ESP | 6.1 and prior |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H