CVE-2023-25909: HGiga Inc. OAKlouds - Arbitrary File Upload
First published: Mon Mar 27 2023(Updated: )
HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.
Credit: twcert@cert.org.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HGiga OAKlouds | >=2.0<2.0-10 | |
| HGiga OAKlouds | >=3.0<3.0-10 |
Remedy
- Update OAKlouds-layout-2.0 to OAKlouds-layout-2.0-10 - Update OAKlouds-layout-3.0 to OAKlouds-layout-3.0-10
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/title
- agent/references
- agent/severity
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/hgiga
- canonical/hgiga oaklouds
- version/hgiga oaklouds/2.0
- version/hgiga oaklouds/3.0