CVE-2023-2738

A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229149 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/RCEraser/cve/blob/main/tongda.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.229149 Permissions Required
https://vuldb.com/?id.229149 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:tongda2000:tongda_office_anywhere:11.10:*:*:*:*:*:*:*

History

16 Dec 2023, 04:28

Type Values Removed Values Added
CPE cpe:2.3:a:tongda2000:tongda_oa:11.10:*:*:*:*:*:*:* cpe:2.3:a:tongda2000:tongda_office_anywhere:11.10:*:*:*:*:*:*:*

25 May 2023, 20:44

Type Values Removed Values Added
CPE cpe:2.3:a:tongda2000:tongda_oa:11.10:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References (MISC) https://vuldb.com/?id.229149 - (MISC) https://vuldb.com/?id.229149 - Permissions Required
References (MISC) https://vuldb.com/?ctiid.229149 - (MISC) https://vuldb.com/?ctiid.229149 - Permissions Required
References (MISC) https://github.com/RCEraser/cve/blob/main/tongda.md - (MISC) https://github.com/RCEraser/cve/blob/main/tongda.md - Exploit, Third Party Advisory

16 May 2023, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-05-16 15:15

Updated : 2024-05-17 02:23


NVD link : CVE-2023-2738

Mitre link : CVE-2023-2738

CVE.ORG link : CVE-2023-2738


JSON object : View

Products Affected

tongda2000

  • tongda_office_anywhere
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type