CVE-2023-3643 HIGH

CVE-2023-3643: Boss Mini document file inclusion

Vendor N/A

Product Boss Mini

Weakness CWE-73

Published July 12, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.

Key dates

02Disclosure timeline

July 12, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-3643 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html

Related vulnerabilities

04Related CVE

CVE-2026-35077 Arbitrary file delete vulnerability in method ugw-delete-file CVE-2026-4132 HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters CVE-2026-45089 Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode CVE-2026-47643 Azure Stack Edge Remote Code Execution Vulnerability CVE-2026-32204 Azure Monitor Agent Elevation of Privilege Vulnerability