CVE-2023-37289
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability of Unrestricted Upload of File with Dangerous Type has been identified in the file uploading function in the InfoDoc Document On-line Submission and Approval System. This allows an unauthenticated remote attacker to exploit this vulnerability to upload and run arbitrary executable files and perform arbitrary system commands.
Risk Assessment
This vulnerability poses a serious risk to organizations as an attacker can remotely upload malicious files, potentially leading to system takeover or service disruption.
Recommendation
It is recommended to implement strict controls on file uploads, including restricting allowed file types and enforcing user authentication mechanisms before file uploads.
Original NVD description (English source)
It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567.