CVE-2024-3123CWE-434

CHANGING Mobile One Time Password - Arbitrary File Upload

High · published July 1, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00593 · 47.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-07-01T02:52Z
EPSS history
Timeline
  • 01 JUL 02:52Z
    CHANGING Mobile One Time Password - Arbitrary File Upload
    cvelistv5