File Upload Vulnerability in Vtenext Application
CVE-2023-46694

8.1HIGH

Key Information:

Vendor

Vtenext

Vendor
CVE Published:
28 May 2024

What is CVE-2023-46694?

The vulnerability present in Vtenext 21.02 allows authenticated users to upload arbitrary files without appropriate validation or authentication controls. This weakness specifically targets the Ckeditor file manager functionality, creating a potential pathway for attackers to execute remote commands on the server. The lack of stringent access controls in the application makes it susceptible to exploitation, posing significant security risks to sensitive data and system integrity.

References

https://github.com/invisiblebyte/CVE-2023-46694

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.