Arbitrary Code Execution in ZenTao Community Edition and Related Products by ZenTao
CVE-2023-44827

8.8HIGH

Key Information:

Vendor

Easycorp

Status
Zentao Max
Zentao Biz
Zentao
Vendor
CVE Published:
10 October 2023

What is CVE-2023-44827?

An arbitrary code execution vulnerability exists in the ZenTao Community Edition, affecting versions 18.6 and earlier, along with ZenTao Biz v.8.6 and earlier, and ZenTao Max v.4.7 and earlier. This vulnerability enables attackers to execute arbitrary code by exploiting a crafted script targeting the Office Conversion Settings function, potentially compromising the affected systems. Prompt action should be taken to mitigate the risks associated with this vulnerability by updating to the latest versions of the product.

References

https://spotted-topaz-6aa.notion.site/Zentao-Authorized-R...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.