Vulnerability · Published Jan 3, 2023 · Assigned by twcert
CVE-2022-43436HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload
High 8.8
In plain English
A high-severity unrestricted file upload in EasyTest from HWA JIUH DIGITAL TECHNOLOGY LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a general user can upload and execute arbitrary files, to manipulate system or disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HWA JIUH DIGITAL TECHNOLOGY LTD. | EasyTest | 22H29 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H