CVE-2023-26578

Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application

State: Published
Severity: 8.8 High
Published: Oct 25, 2023
Updated: Sep 10, 2024
Reserved: Feb 26, 2023

Description

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	TML

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
IDWebIDAttend Pty Ltd	3.1.052 and earlierAffected

References

https://www.themissinglink.com.au/security-advisories/cve-2023-26578

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.