CVE-2023-32637 File upload in GBrowse
Attackers can upload malicious files to GBrowse to execute arbitrary code on the server due to lack of file type validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32637?
CVE-2023-32637 is a critical vulnerability in Generic Model Organism Database Project GBrowse, published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.
Weakness: CWE-434
Which versions are affected by CVE-2023-32637?
It affects 1 product.
Products include Gmod Gbrowse.
How do I fix CVE-2023-32637?
Apply the vendor's patch.
Is CVE-2023-32637 being exploited?
There is no known exploitation of CVE-2023-32637 in the wild and no public exploit code.
Other vulnerabilities in Generic Model Organism Database Project GBrowse
Sources
Also known as DEBIAN-CVE-2023-32637, GHSA-jffq-5gqv-qfcx.