CVE-2023-26578CWE-22CWE-434

Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application

High · published October 25, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
73.5
In the wild
Unconfirmed
What it is

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01463 · 73.5th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-10-25T09:43Z
EPSS history
Timeline
  • 25 OCT 09:43Z
    Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application
    cvelistv5