CVE-2023-37289

20.07.2023, 03:15

It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in  InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
twcert	CNA	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
infodoc	document_on-line_submission_and_approval_system	22547	CNA
infodoc	document_on-line_submission_and_approval_system	22567	CNA

Common Weakness Enumeration

CWE-434 - Unrestricted Upload of File with Dangerous Type
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

References

https://www.twcert.org.tw/tw/cp-132-7225-cef32-1.html