{"id":"CVE-2023-32757","state":"PUBLISHED","title":"e-Excellence U-Office Force - Arbitrary File Upload","description":"\ne-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.\n\n","publishedAt":"2023-08-25T07:29:05.292Z","updatedAt":"2024-10-02T17:38:10.035Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["e-Excellence U-Office Force"],"affected":[{"vendor":"e-Excellence","product":"U-Office Force","defaultStatus":"unaffected","versions":[{"version":"20.0.7668D","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/32xxx/CVE-2023-32757.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-32757","state":"PUBLISHED","datePublished":"2023-08-25T07:29:05.292Z","dateUpdated":"2024-10-02T17:38:10.035Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2023-05-15T02:46:49.300Z"},"containers":{"cna":{"title":"e-Excellence U-Office Force - Arbitrary File Upload","descriptions":[{"lang":"en","value":"\ne-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.\n\n"}],"affected":[{"vendor":"e-Excellence","product":"U-Office Force","defaultStatus":"unaffected","versions":[{"version":"20.0.7668D","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2023-08-25T07:29:05.292Z"},"datePublic":"2023-08-31T01:00:00.000Z","impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n\n\nUpdate version to 24.50SP1 or later.<br>"}],"value":"\n\n\nUpdate version to 24.50SP1 or later.\n"}],"source":{"advisory":"TVN-202308003","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T15:25:37.071Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-02T17:37:58.270813Z","id":"CVE-2023-32757","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-02T17:38:10.035Z"}}]}}}