CVE-2023-41357

Galaxy Software Services Vitals ESP - Arbitrary File Upload

State: Published
Severity: 8.8 High
Published: Nov 3, 2023
Updated: Sep 5, 2024
Reserved: Aug 29, 2023

Description

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
Vitals ESPGalaxy Software Services	6.1 and priorAffected

References

https://www.twcert.org.tw/tw/cp-132-7508-6d1ef-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.