Vulnerability-Lookup

GHSA-CPJ9-WVVX-V589

Vulnerability from github – Published: 2023-12-29 09:30 – Updated: 2023-12-29 09:30

Details

A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.

Severity ?

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-7159"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-29T07:15:11Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.",
  "id": "GHSA-cpj9-wvvx-v589",
  "modified": "2023-12-29T09:30:25Z",
  "published": "2023-12-29T09:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7159"
    },
    {
      "type": "WEB",
      "url": "https://note.zhaoj.in/share/FE79uijyqmG7"
    },
    {
      "type": "WEB",
      "url": "https://note.zhaoj.in/share/jNbywlXI46HV"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.249181"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.249181"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-7159 (GCVE-0-2023-7159)

Vulnerability from cvelistv5 – Published: 2023-12-29 07:00 – Updated: 2024-08-02 08:50

Title

gopeak MasterLab User.php update unrestricted upload

Summary

Severity ?

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.7 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-434 - Unrestricted Upload

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.249181	vdb-entrytechnical-description
	https://vuldb.com/?ctiid.249181	signaturepermissions-required
	https://note.zhaoj.in/share/jNbywlXI46HV	broken-linkexploit
	https://note.zhaoj.in/share/FE79uijyqmG7	broken-link

Impacted products

	Vendor	Product	Version
	gopeak	MasterLab	Affected: 3.3.0 Affected: 3.3.1 Affected: 3.3.2 Affected: 3.3.3 Affected: 3.3.4 Affected: 3.3.5 Affected: 3.3.6 Affected: 3.3.7 Affected: 3.3.8 Affected: 3.3.9 Affected: 3.3.10

Credits

glzjin (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:50:08.272Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.249181"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.249181"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://note.zhaoj.in/share/jNbywlXI46HV"
          },
          {
            "tags": [
              "broken-link",
              "x_transferred"
            ],
            "url": "https://note.zhaoj.in/share/FE79uijyqmG7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MasterLab",
          "vendor": "gopeak",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.3.1"
            },
            {
              "status": "affected",
              "version": "3.3.2"
            },
            {
              "status": "affected",
              "version": "3.3.3"
            },
            {
              "status": "affected",
              "version": "3.3.4"
            },
            {
              "status": "affected",
              "version": "3.3.5"
            },
            {
              "status": "affected",
              "version": "3.3.6"
            },
            {
              "status": "affected",
              "version": "3.3.7"
            },
            {
              "status": "affected",
              "version": "3.3.8"
            },
            {
              "status": "affected",
              "version": "3.3.9"
            },
            {
              "status": "affected",
              "version": "3.3.10"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "glzjin (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "In gopeak MasterLab bis 3.3.10 wurde eine kritische Schwachstelle ausgemacht. Das betrifft die Funktion add/update der Datei app/ctrl/admin/User.php. Durch das Beeinflussen des Arguments avatar mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:30:50.274Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.249181"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.249181"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://note.zhaoj.in/share/jNbywlXI46HV"
        },
        {
          "tags": [
            "broken-link"
          ],
          "url": "https://note.zhaoj.in/share/FE79uijyqmG7"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-12-28T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-12-28T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2024-01-20T13:18:23.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "gopeak MasterLab User.php update unrestricted upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-7159",
    "datePublished": "2023-12-29T07:00:05.537Z",
    "dateReserved": "2023-12-28T14:39:02.258Z",
    "dateUpdated": "2024-08-02T08:50:08.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-CPJ9-WVVX-V589

CVE-2023-7159 (GCVE-0-2023-7159)

Tags

Sightings

Nomenclature