Vulnerability · Published Oct 27, 2023 · Assigned by mitre
CVE-2023-46818
High 7.2
In plain English
A high-severity code injection in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 19.2% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)19.2%top 2.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling3Metasploit, Nuclei, Public PoC
Official description
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H