CVE-2023-45188

CWE-434 — Unrestricted File Upload3 documents3 sources

Severity

9.8CRITICAL

EPSS

0.2%

top 59.91%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Engineering Lifecycle Optimization Publishing

Timeline

PublishedJun 9

Description

IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 268751.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/engineering_lifecycle_optimization_publishing7.0.2, 7.0.3

▶NVDibm/engineering_lifecycle_optimization_publishing7.0.2, 7.0.3+1

🔴Vulnerability Details

CVEList

IBM Engineering Lifecycle Optimization Publishing file upload↗2024-06-09

▶

GHSA

GHSA-83gq-52q2-4f4v: IBM Engineering Lifecycle Optimization Publishing 7↗2024-06-09

▶