Unrestricted Upload Vulnerability in DeDeCMS Backend Component
CVE-2023-7212

9.8CRITICAL

Key Information:

Vendor

Dedecms

Status
Dedecms
Vendor
CVE Published:
7 January 2024

What is CVE-2023-7212?

A vulnerability has been identified in DeDeCMS that allows for unrestricted file uploads via the file_class.php component of its Backend. This issue can be exploited remotely, potentially allowing attackers to upload malicious files to the server. Given that the exploit has already been publicly disclosed, urgency is required in addressing this vulnerability to prevent unwanted access and potential damage to the web application and its users.

References

https://vuldb.com/?id.249768
https://vuldb.com/?ctiid.249768
https://hmxwjm7x03.feishu.cn/docx/FPjhdYcQvocR4gxy34Rc0pm...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.