CVE-2023-2647: Weaver E-Office File Upload utility_all.php command injection

Published May 11, 2023

Updated

A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utilityall.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

weaver E-Office=9.5

Event History

May 11, 2023

CVE Published

07:31 AM

Data Sourced

07:31 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-2647?

CVE-2023-2647 is classified as a critical vulnerability due to its potential for command injection.

How do I fix CVE-2023-2647?

To fix CVE-2023-2647, it is recommended to update Weaver E-Office to a patched version that resolves the vulnerability.

What component is affected by CVE-2023-2647?

CVE-2023-2647 affects the file upload handler functionality in the file /webroot/inc/utility_all.php of Weaver E-Office 9.5.

What kind of vulnerability is CVE-2023-2647?

CVE-2023-2647 is a command injection vulnerability that allows attackers to execute arbitrary commands on the server.

What software version is impacted by CVE-2023-2647?

CVE-2023-2647 specifically impacts Weaver E-Office version 9.5.