CVE-2023-3798 MEDIUM

CVE-2023-3798: Chengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted upload

Vendor Chengdu
Product Flash Flood Disaster Monitoring and Warning System
Weakness CWE-434 · Unrestricted file upload
Published July 20, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown code of the file /App_Resource/UEditor/server/upload.aspx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

July 20, 2023 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-49291 WordPress Cooked Pro plugin < 1.8.0 - Unauthenticated Arbitrary File Upload vulnerability CVE-2026-22786 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal CVE-2025-10747 WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload CVE-2024-7944 itsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted upload CVE-2024-10420 SourceCodester Attendance and Payroll System update.php upload unrestricted upload