CVE-2023-48394

{"id": "CVE-2023-48394", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-12-15T10:15:08.237", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7624-d0300-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service."}, {"lang": "es", "value": "Kaifa Technology WebITR es un sistema de asistencia en l\u00ednea, su funci\u00f3n de carga de archivos no restringe la carga de archivos con tipos peligrosos. Un atacante remoto con privilegios de usuario normal puede aprovechar esta vulnerabilidad para cargar archivos arbitrarios y ejecutar comandos arbitrarios o interrumpir el servicio."}], "lastModified": "2023-12-22T15:33:02.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kaifa:webitr_attendance_system:2.1.0.23:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B300C11-0A7F-409F-9D3C-3CE08E366D75"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}