CVE-2023-32637

published 2023-07-25

CVE-2023-32637: GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	gbrowse	< gbrowse 2.56+dfsg-1 (bookworm)	gbrowse 2.56+dfsg-1 (bookworm)
generic_model_organism_database_project	gbrowse	—	—
generic_model_organism_database_project	gbrowse	>= 0 < 2.56+dfsg-1	2.56+dfsg-1
generic_model_organism_database_project	gbrowse	>= 0 < 2.56+dfsg-1	2.56+dfsg-1
generic_model_organism_database_project	gbrowse	>= 0 < 2.56+dfsg-1	2.56+dfsg-1

Detection & IOCs extracted from sources · hover to see the quote

• → GBrowse allows unauthenticated web requests to access uploaded files of any format; monitor web-accessible upload directories for script files (e.g., .pl, .cgi, .php) that could enable remote code execution ↗

• · The vulnerability is fixed in GBrowse version 2.56+dfsg-1 on Debian bookworm, bullseye, and trixie; systems running older versions remain exploitable ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv 9.8 CRITICAL

vendor_debian 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434