CVE-2023-51644: falha crítica em Allegra
Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 2.0%
Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the configuration of Struts. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22512.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Allegra · AllegraCVEs relacionadas — Allegra
No mesmo produto, das mais perigosas para as menos.
CVE-2025-6216CRITICALAllegra calculateTokenExpDate Password Recovery Authentication Bypass VulnerabilityEPSS 47.8%CVE-2023-51639CRITICALAllegra downloadExportedChart Directory Traversal Authentication Bypass VulnerabilityEPSS 2.5%CVE-2024-5581HIGHAllegra unzipFile Directory Traversal Remote Code Execution VulnerabilityEPSS 2.4%CVE-2023-51647HIGHAllegra saveInlineEdit Directory Traversal Remote Code Execution VulnerabilityEPSS 2.2%CVE-2023-51643HIGHAllegra uploadFile Directory Traversal Remote Code Execution VulnerabilityEPSS 2.2%CVE-2023-52332HIGHAllegra serveMathJaxLibraries Directory Traversal Information Disclosure VulnerabilityEPSS 2.1%