CVE-2023-3491
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
In the GitHub repository fossbilling/fossbilling prior to version 0.5.3, there is an unrestricted upload of files with dangerous types.
Risk Assessment
The ability to upload dangerous files may lead to malware or attacks on the organization's systems.
Recommendation
It is recommended to upgrade to version 0.5.3 or later to mitigate this vulnerability.
Other vulnerabilities in fossbilling/fossbilling
See all- CVE-2023-4005Critical
Insufficient session expiration exists in GitHub repository fossbilling/fossbilling prior to version 0.5.5.
- CVE-2023-3490Critical
There is an SQL Injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.3.
- CVE-2023-3521Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository fossbilling/fossbilling prior to version 0.5.4.
- CVE-2023-3493High
In the GitHub repository fossbilling/fossbilling prior to version 0.5.3, there is improper neutralization of formula elements in a CSV file.
- CVE-2023-3394Medium
There is a Session Fixation vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.
- CVE-2023-3393High
There is a code injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.
- CVE-2023-3229Medium
Business logic errors in the GitHub repository fossbilling/fossbilling prior to version 0.5.0 may lead to unauthorized access or improper data processing.
- CVE-2023-3228Medium
Business Logic Errors in the GitHub repository fossbilling/fossbilling prior to version 0.5.0 may lead to unauthorized access or improper data processing.
- CVE-2023-3227Medium
Insufficient granularity of access control exists in the GitHub repository fossbilling/fossbilling prior to version 0.5.0.
Original NVD description (English source)
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.