Vulnerability · Published Jul 12, 2023 · Assigned by VulDB

CVE-2023-3643Boss Mini document file inclusion

High 7.3

In plain English

A high-severity security flaw in Boss Mini. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 75.4% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)75.4%top 0.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Boss Mini	1.4.0 Build 6221

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.233889 vdb-entry, technical-description
https://vuldb.com/?ctiid.233889 signature, permissions-required
https://drive.google.com/file/d/1RXmDUAjqZvWSvHUrfRerz7My6M3KX7YG/view exploit