VulnerabilityModified
CVE-2023-50090
Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.
CRITICAL 9.8EPSS 0.77%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.77% probability · 54th percentile
- CISA KEV
- Not listed
- Affected
- ureport2 project/ureport2
- Source
- cve@mitre.org
References
- https://lemono.fun/thoughts/UReport2-RCE.htmlBroken Link
- https://github.com/advisories/GHSA-445x-c8qq-qfr9Third Party Advisory
- https://lemono.fun/thoughts/UReport2-RCE.htmlBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.