CVE-2023-39933 File upload in pmc.exe
Attackers can upload malicious files to the mail server to execute arbitrary code with web server privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39933?
CVE-2023-39933 is a medium-severity vulnerability in A.K.I Software pmc.exe, published on 18 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a user who can upload files through the product may execute an arbitrary executable file with the web server's execution privilege.
Weakness: CWE-434
Which versions are affected by CVE-2023-39933?
How do I fix CVE-2023-39933?
No fix has been published for CVE-2023-39933 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-39933 being exploited?
There is no known exploitation of CVE-2023-39933 in the wild and no public exploit code.
Sources
Also known as GHSA-qgvx-mvf3-xw8r.