CVE-2023-25132

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads	Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads	Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads	Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads	Product
https://zuso.ai/Advisory/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cyberpower:powerpanel:::::business:linux::
	cpe:2.3:a:cyberpower:powerpanel:::::business:macos::
	cpe:2.3:a:cyberpower:powerpanel:::::business:virtual_machine::
	cpe:2.3:a:cyberpower:powerpanel:::::business:windows::

History

No history.

Information

Published : 2023-04-24 10:15

Updated : 2023-05-02 20:19

NVD link : CVE-2023-25132

Mitre link : CVE-2023-25132

CVE.ORG link : CVE-2023-25132

JSON object : View

Products Affected

cyberpower

powerpanel

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2023-25132", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ART@zuso.ai", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2023-04-24T10:15:07.237", "references": [{"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://zuso.ai/Advisory/", "tags": ["Third Party Advisory"], "source": "ART@zuso.ai"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "ART@zuso.ai", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors."}], "lastModified": "2023-05-02T20:19:38.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:linux:*:*", "vulnerable": true, "matchCriteriaId": "231B7053-0BD9-4C08-8028-72F30768EF48", "versionEndIncluding": "4.8.6"}, {"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:macos:*:*", "vulnerable": true, "matchCriteriaId": "B38A1026-EED6-4606-B61A-F6FDCBF3BB4C", "versionEndIncluding": "4.8.6"}, {"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:virtual_machine:*:*", "vulnerable": true, "matchCriteriaId": "4DD5C6C4-2DBD-4C67-A10C-43A293ABD1A7", "versionEndIncluding": "4.8.6"}, {"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:windows:*:*", "vulnerable": true, "matchCriteriaId": "CA11A0E7-FAC1-4BF1-85D4-7370EAC1E0C2", "versionEndIncluding": "4.8.6"}], "operator": "OR"}]}], "sourceIdentifier": "ART@zuso.ai"}