CVE-2023-43838: Malicious File Upload

Published Oct 4, 2023

Updated

An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.

Affected Software

1 affected component

personal-management-system Personal Management System=1.4.64

Event History

Oct 4, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is CVE-2023-43838?

CVE-2023-43838 is an arbitrary file upload vulnerability in Personal Management System v1.4.64 that allows attackers to execute arbitrary code by uploading a crafted SVG file into a user profile's avatar.

How can an attacker exploit CVE-2023-43838?

An attacker can exploit CVE-2023-43838 by uploading a specially crafted SVG file into a user profile's avatar, which will then be executed as arbitrary code.

What is the severity of CVE-2023-43838?

CVE-2023-43838 has a severity value of 7.8 (high).

How can I fix CVE-2023-43838?

To fix CVE-2023-43838, it is recommended to update Personal Management System to version 1.4.65 or later, which addresses the arbitrary file upload vulnerability.

What is CWE-434?

CWE-434 refers to unrestricted file upload, which is a common vulnerability that allows an attacker to upload arbitrary files into a system to execute malicious code.