CVE-2023-41357 — Galaxy Software Services Vitals ESP - Arbitrary File Upload

CVE-2023-41357

Galaxy Software Services Vitals ESP - Arbitrary File Upload PUBLISHED

Description (CNA)

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.

Affected (CNA)

Vendor / product	Versions
Galaxy Software Services / Vitals ESP	affected 6.1 and prior

CWE

CWE-434

References

https://www.twcert.org.tw/tw/cp-132-7508-6d1ef-1.html

ADP enrichment

CVE

No English description supplied.

https://www.twcert.org.tw/tw/cp-132-7508-6d1ef-1.html

CISA-ADP

No English description supplied.

No references supplied.