CVE-2023-3232 Zhong Bang CRMEB Image Upload app_auth deserialization
Attacker can achieve remote code execution via unsafe deserialization in the WeChat app_auth endpoint of CRMEB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3232?
CVE-2023-3232 is a medium-severity unsafe deserialization vulnerability in Zhong Bang CRMEB, published on 14 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_auth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231503. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-502
Which versions are affected by CVE-2023-3232?
It affects 1 product.
Products include Crmeb Crmeb.
How do I fix CVE-2023-3232?
No fix has been published for CVE-2023-3232 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-3232 being exploited?
There is no known exploitation of CVE-2023-3232 in the wild and no public exploit code.
Other vulnerabilities in Zhong Bang CRMEB
Sources
Also known as GHSA-38xh-3m6v-28q5.