cbcvebase.
CVE-2023-35189
published 2023-07-18

CVE-2023-35189: Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a…

PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.91%
55.4th percentile
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.

Affected

1 ranges
VendorProductVersion rangeFixed in
iagonascrutisweb<= 2.1.37—

Detection & IOCsextracted from sources · hover to see the quote

  • →CVE-2023-35189 is an unrestricted file upload (CWE-434) vulnerability in Iagona ScrutisWeb ≤2.1.37 allowing unauthenticated remote code execution via malicious payload upload and execution — monitor for unexpected file uploads (e.g., web shells, scripts) to the ScrutisWeb web application directory by unauthenticated sessions. ↗
  • →The vulnerability is exploitable remotely with low attack complexity and requires no authentication (CVSS AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — prioritize detection of unauthenticated HTTP POST requests to ScrutisWeb file upload endpoints. ↗
  • →ScrutisWeb is a web application; alert on file uploads of dangerous types (e.g., .jsp, .php, .aspx, .war) to the application by sessions with no prior authentication, as the vulnerability class is CWE-434 (Unrestricted Upload of File with Dangerous Type). ↗
  • ·No known public exploits specifically targeting CVE-2023-35189 were identified at time of advisory publication; threat landscape may have changed. ↗
  • ·The advisory covers four CVEs in the same product (CVE-2023-33871, CVE-2023-38257, CVE-2023-35763, CVE-2023-35189); chained exploitation is plausible — e.g., using the IDOR (CVE-2023-38257) and hardcoded key (CVE-2023-35763) to obtain credentials before uploading a payload via CVE-2023-35189. ↗
  • ·Affected versions are ScrutisWeb 2.1.37 and prior; version 2.1.38 is the patched release. Ensure version identification is accurate before applying detection logic. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.