Vulnerability · Published Jul 20, 2023 · Assigned by twcert
CVE-2023-37289InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Document On-line Submission and Approval System from InfoDoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| InfoDoc | Document On-line Submission and Approval System | 2254722567 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H