CVE-2023-32225 - Vulnerability Details - OpenCVE

ReportizFlow

Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Sysaid	Sysaid On-premises

Configuration 1 [-]

cpe:2.3:a:sysaid:sysaid_on-premises:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

History

Mon, 21 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: INCD

Published: 2023-07-30T07:16:24.730Z

Updated: 2024-10-21T17:53:17.063Z

Reserved: 2023-05-04T20:53:11.224Z

Link: CVE-2023-32225

Vulnrichment

Updated: 2024-08-02T15:10:23.902Z

NVD

Status : Modified

Published: 2023-07-30T08:15:46.760

Modified: 2024-11-21T08:02:56.230

Link: CVE-2023-32225

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32225", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2023-05-04T20:53:11.224Z", "datePublished": "2023-07-30T07:16:24.730Z", "dateUpdated": "2024-10-21T17:53:17.063Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Sysaid", "vendor": "Sysaid", "versions": [{"lessThan": "23.2.14 b18", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Niv Levy"}], "datePublic": "2023-07-30T06:54:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": " Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - \n\n<span style=\"background-color: rgb(255, 255, 255);\">A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.</span>\n\n"}], "value": " Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -\u00a0\n\nA malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2023-07-30T07:16:24.730Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Update to version 23.2.14 b18 (On-Prem). </span>\n\n<br>"}], "value": "\nUpdate to version 23.2.14 b18 (On-Prem). \n\n\n"}], "source": {"advisory": "ILVN-2023-0112", "discovery": "UNKNOWN"}, "title": " Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:23.902Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-21T17:53:01.794733Z", "id": "CVE-2023-32225", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T17:53:17.063Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:23.902Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32225", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T17:53:01.794733Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T17:53:11.267Z"}}], "cna": {"title": " Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type", "source": {"advisory": "ILVN-2023-0112", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Niv Levy"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Sysaid", "product": "Sysaid", "versions": [{"status": "affected", "version": "All versions", "lessThan": "23.2.14 b18", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nUpdate to version 23.2.14 b18 (On-Prem). \n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Update to version 23.2.14 b18 (On-Prem). </span>\n\n<br>", "base64": false}]}], "datePublic": "2023-07-30T06:54:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": " Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -\u00a0\n\nA malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.\n\n", "supportingMedia": [{"type": "text/html", "value": " Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - \n\n<span style=\"background-color: rgb(255, 255, 255);\">A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2023-07-30T07:16:24.730Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32225", "state": "PUBLISHED", "dateUpdated": "2024-10-21T17:53:17.063Z", "dateReserved": "2023-05-04T20:53:11.224Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2023-07-30T07:16:24.730Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}