CVE-2022-41573

EPSS 1.19%
Veröffentlicht 07.01.2025 20:15:28
Zuletzt bearbeitet 15.04.2026 00:35:42
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading of executable files. A user can upload a .png file containing PHP code and then rename it to have the .php extension. It will then be accessible at an images/common/ URI for remote code execution.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

CNA 0 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.19%	0.639

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://github.com/Orange-Cyberdefense/CVE-repository/

https://bitbucket.org/cantico/ovidentia/branches/

https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/poc_CVE-2022-41573.txt

https://nvd.nist.gov/vuln/detail/CVE-2022-41573

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-41573

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-41573

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-41573