{"id":"CVE-2023-26578","state":"PUBLISHED","title":"Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application","description":"Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.  ","publishedAt":"2023-10-25T09:43:54.725Z","updatedAt":"2024-09-10T20:33:27.301Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"TML"},"assigner":"TML","products":["IDAttend Pty Ltd IDWeb"],"affected":[{"vendor":"IDAttend Pty Ltd","product":"IDWeb","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.052","versionType":"major"}]}],"references":["https://www.themissinglink.com.au/security-advisories/cve-2023-26578"],"weaknesses":["CWE-22","CWE-434"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/26xxx/CVE-2023-26578.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-26578","state":"PUBLISHED","datePublished":"2023-10-25T09:43:54.725Z","dateUpdated":"2024-09-10T20:33:27.301Z","assignerShortName":"TML","assignerOrgId":"07aac9b9-e3e9-4d03-a447-764bd31371d7","dateReserved":"2023-02-26T06:25:18.748Z"},"containers":{"cna":{"title":"Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application","descriptions":[{"lang":"en","value":"Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.  "}],"affected":[{"vendor":"IDAttend Pty Ltd","product":"IDWeb","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.052","versionType":"major"}]}],"references":[{"url":"https://www.themissinglink.com.au/security-advisories/cve-2023-26578"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"TML","orgId":"07aac9b9-e3e9-4d03-a447-764bd31371d7","dateUpdated":"2023-10-26T06:43:42.336Z"},"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]},{"capecId":"CAPEC-650","descriptions":[{"lang":"en","value":"CAPEC-650 Upload a Web Shell to a Web Server"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.themissinglink.com.au/security-advisories/cve-2023-26578","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:53:53.764Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-10T20:33:18.442870Z","id":"CVE-2023-26578","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-10T20:33:27.301Z"}}]}}}