CVE-2023-48376 CRITICAL

CVE-2023-48376: SmartStar Software CWS Web-Base - Arbitrary File Upload

Vendor Smartstar Software

Product CWS Web-Base

Weakness CWE-434 · Unrestricted file upload

Published December 15, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.

Key dates

02Disclosure timeline

December 15, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-48376 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-7770 Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-7450 itsourcecode Placement Management System Image resume_upload.php unrestricted upload CVE-2023-4186 SourceCodester Pharmacy Management System manage_website.php unrestricted upload CVE-2025-24775 WordPress Forms <= 2.9.0 - Arbitrary File Upload Vulnerability CVE-2022-50916 e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override