CVE-2023-32637

Published Jul 25, 2023

Last updated 3 months ago

CVSS critical 9.8

Overview

Description: GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.
Source: vultures@jpcert.or.jp
NVD status: Modified
CNA Tags: unsupported-when-assigned

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gmod:gbrowse:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "382CF885-3467-4CC3-8CDC-4533F52B6B7D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References