CVE-2023-3798
MediumCVSS 5.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A critical vulnerability has been found in the Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It affects unknown code in the file /App_Resource/UEditor/server/upload.aspx, leading to unrestricted file uploads.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the system and potential introduction of malicious software. Organizations should be aware of the risks associated with the publicly disclosed exploit.
Recommendation
It is recommended to immediately update the system to the latest version and implement appropriate security measures to minimize the risk of unauthorized file uploads.
Original NVD description (English source)
A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown code of the file /App_Resource/UEditor/server/upload.aspx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.