CVE-2023-4097 Multiple vulnerabilities in IDM Sistemas QSige
Authenticated attackers can upload arbitrary files due to improper validation, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4097?
CVE-2023-4097 is a high-severity vulnerability in IDM Sistemas QSige QSige, published on 3 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.
Weakness: CWE-434
Which versions are affected by CVE-2023-4097?
It affects 1 product.
Products include Qsige Qsige.
How do I fix CVE-2023-4097?
No fix has been published for CVE-2023-4097 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4097 being exploited?
There is no known exploitation of CVE-2023-4097 in the wild and no public exploit code.
Other vulnerabilities in IDM Sistemas QSige QSige
- CVE-2023-4098 Multiple vulnerabilities in IDM Sistemas QSige
- CVE-2023-4101 Multiple vulnerabilities in IDM Sistemas QSige
- CVE-2023-4102 Multiple vulnerabilities in IDM Sistemas QSige
- CVE-2023-4103 Multiple vulnerabilities in IDM Sistemas QSige
- CVE-2023-4099 Multiple vulnerabilities in IDM Sistemas QSige
Sources
Also known as GHSA-8mx5-wvh2-fvmf.