CVE-2023-3491 - Vulnerability Details - OpenCVE

Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Fossbilling	Fossbilling

Configuration 1 [-]

cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114
https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d

History

Mon, 04 Nov 2024 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2023-06-30T21:11:09.527Z

Updated: 2024-11-04T20:57:03.914Z

Reserved: 2023-06-30T21:10:57.830Z

Link: CVE-2023-3491

Vulnrichment

Updated: 2024-08-02T06:55:03.637Z

NVD

Status : Modified

Published: 2023-06-30T22:15:10.393

Modified: 2024-11-21T08:17:23.067

Link: CVE-2023-3491

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3491", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntrdev", "dateReserved": "2023-06-30T21:10:57.830Z", "datePublished": "2023-06-30T21:11:09.527Z", "dateUpdated": "2024-11-04T20:57:03.914Z"}, "containers": {"cna": {"title": "Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2023-06-30T21:11:09.527Z"}, "descriptions": [{"lang": "en", "value": "Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3."}], "affected": [{"vendor": "fossbilling", "product": "fossbilling/fossbilling", "versions": [{"version": "unspecified", "lessThan": "0.5.3", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d"}, {"url": "https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434"}]}], "source": {"advisory": "043bd900-ac78-44d2-a340-84ddd0bc4a1d", "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:55:03.637Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d", "tags": ["x_transferred"]}, {"url": "https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "fossbilling", "product": "fossbilling", "cpes": ["cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.5.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-04T20:55:20.678372Z", "id": "CVE-2023-3491", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T20:57:03.914Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d", "tags": ["x_transferred"]}, {"url": "https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:55:03.637Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-3491", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-04T20:55:20.678372Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*"], "vendor": "fossbilling", "product": "fossbilling", "versions": [{"status": "affected", "version": "0", "lessThan": "0.5.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T20:56:58.229Z"}}], "cna": {"title": "Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling", "source": {"advisory": "043bd900-ac78-44d2-a340-84ddd0bc4a1d", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fossbilling", "product": "fossbilling/fossbilling", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "0.5.3", "versionType": "custom"}]}], "references": [{"url": "https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d"}, {"url": "https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114"}], "descriptions": [{"lang": "en", "value": "Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2023-06-30T21:11:09.527Z"}}}, "cveMetadata": {"cveId": "CVE-2023-3491", "state": "PUBLISHED", "dateUpdated": "2024-11-04T20:57:03.914Z", "dateReserved": "2023-06-30T21:10:57.830Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2023-06-30T21:11:09.527Z", "assignerShortName": "@huntrdev"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*", "matchCriteriaId": "FBB9E4E5-B7F6-4CD5-BC9B-BEB53D588084", "versionEndExcluding": "0.5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3."}], "id": "CVE-2023-3491", "lastModified": "2024-11-21T08:17:23.067", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-06-30T22:15:10.393", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@huntr.dev", "type": "Secondary"}]}