CVE-2023-41357 HIGH

CVE-2023-41357: Galaxy Software Services Vitals ESP - Arbitrary File Upload

Vendor Galaxy Software Services
Product Vitals ESP
Weakness CWE-434 · Unrestricted file upload
Published November 3, 2023
Last update September 5, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.

Key dates

02Disclosure timeline

November 3, 2023 CVE published
September 5, 2024 Record updated