CVE-2023-48376criticalCWE-434

CVE-2023-48376: critical vulnerability in SmartStar Software CWS Web-Base

SmartStar Software CWS Web-Base - Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor CWS Web-Base

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.0%
SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SmartStar Software · CWS Web-Base
Related CVEs — SmartStar Software CWS Web-Base

In the same product, most dangerous first.

CVE-2023-48375HIGHSmartStar Software CWS Web-Base - Broken Access ControlEPSS 0.7%CVE-2023-48374MEDIUMSmartStar Software CWS Web-Base - Use of Hard-coded CredentialsEPSS 0.6%