CVE-2023-24187

Опубликовано: 14 фев. 2023

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.

Ссылки

http://ureport.com
Product
https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24187.md
Exploit
Third Party Advisory
https://github.com/cgddgc/vulns/blob/main/ureport2-vuln-des.md
Exploit
Third Party Advisory
https://github.com/youseries/ureport
Product
http://ureport.com
Product
https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24187.md
Exploit
Third Party Advisory
https://github.com/cgddgc/vulns/blob/main/ureport2-vuln-des.md
Exploit
Third Party Advisory
https://github.com/youseries/ureport
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ureport_project:ureport:2.2.9:*:*:*:*:*:*:*

EPSS

Процентиль: 14%

0.00047

Низкий

7.8 High

CVSS3

Дефекты

CWE-611

Связанные уязвимости

GHSA-fhj6-gr87-g4cj