Lucene search

IcscertCVE-2023-35189

HistoryJul 18, 2023 - 6:15 p.m.

CVE-2023-35189

2023-07-1818:15:12

CWE-434

icscert

web.nvd.nist.gov

iagona scrutisweb

remote code execution

cve-2023-35189

vulnerability

security

upload

malicious payload

unauthenticated user

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

62.3%

JSON

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote
code execution vulnerability that could allow an unauthenticated user to
upload a malicious payload and execute it.

Affected configurations

Nvd

Node

iagonascrutiswebRange≤2.1.37

VendorProductVersionCPE
iagonascrutisweb*cpe:2.3:a:iagona:scrutisweb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
iagona	scrutisweb	*	cpe:2.3:a:iagona:scrutisweb::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ScrutisWeb",
    "vendor": "iagona",
    "versions": [
      {
        "lessThanOrEqual": "2.1.37",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-199-03

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

62.3%

JSON

Related for CVE-2023-35189