e-Excellence U-Office Force - Arbitrary File Upload
CVE-2023-32757

9.8CRITICAL

Key Information:

Vendor

E-excellence

Status
U-office Force
Vendor
CVE Published:
25 August 2023

What is CVE-2023-32757?

The file uploading function in e-Excellence U-Office Force is vulnerable as it fails to secure file types when uploaded by an unauthenticated user. This weakness allows attackers to upload potentially malicious files without authentication, which could be exploited to perform arbitrary commands or disrupt the service entirely. Ensuring proper validation and access controls is crucial to mitigating this risk.

Affected Version(s)

U-Office Force 20.0.7668D

References

https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.