CVE-2019-25714
CriticalSummary
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint, allowing remote attackers to write arbitrary files to the web root via crafted POST requests with base64. This enables uploading JSP webshells and executing OS commands.
Risk Assessment
Risk of full server compromise by a remote unauthenticated attacker, potentially leading to data breach and further attacks.
Recommendation
Immediately upgrade Seeyon OA A8 to a patched version and restrict access to the /seeyon/htmlofficeservlet endpoint.
Original NVD description (English source)
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC).