CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload
Authenticated attackers can upload malicious scripts to execute arbitrary code or disrupt service in the Vitals ESP knowledge base portal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41357?
CVE-2023-41357 is a high-severity vulnerability in Galaxy Software Services Vitals ESP , published on 3 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.
Weakness: CWE-434
Which versions are affected by CVE-2023-41357?
It affects 1 product.
Products include Gss Vitals Enterprise Social Platform.
How do I fix CVE-2023-41357?
No fix has been published for CVE-2023-41357 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41357 being exploited?
There is no known exploitation of CVE-2023-41357 in the wild and no public exploit code.
Other vulnerabilities in Galaxy Software Services Vitals ESP
Sources
Also known as GHSA-68g4-f9x4-95f2.