CVE-2023-0670 File upload in Ulearn
An administrator can achieve remote code execution on the Ulearn server by uploading malicious files disguised as images due to lack of validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0670?
CVE-2023-0670 is a high-severity vulnerability in Ulearn, published on 5 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not validate that the uploaded image is actually an image.
Weakness: CWE-434
Which versions are affected by CVE-2023-0670?
It affects 1 product.
Products include Ulearn Project Ulearn.
How do I fix CVE-2023-0670?
No fix has been published for CVE-2023-0670 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0670 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0670 exists.
Sources
Also known as GHSA-vg83-7v95-762v.