CVE-2023-5297: Xinhu RockOA start backup

Published Sep 29, 2023

Updated

A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240927.

Affected Software

1 affected component

Rockoa RockOA=2.3.2

Event History

Sep 29, 2023

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-5297?

The severity of CVE-2023-5297 is high.

How does CVE-2023-5297 affect Xinhu RockOA?

CVE-2023-5297 affects Xinhu RockOA version 2.3.2 by exposing backup files to an unauthorized control sphere.

Is CVE-2023-5297 exploitable remotely?

Yes, CVE-2023-5297 can be exploited remotely.

What is the Common Vulnerabilities and Exposures (CVE) ID of this vulnerability?

The Common Vulnerabilities and Exposures (CVE) ID of this vulnerability is CVE-2023-5297.

What is the CWE ID of CVE-2023-5297?

The CWE ID of CVE-2023-5297 is 552 (Files or Directories Accessible to External Parties) and 530 (Exposure of Backup File to an Unauthorized Control Sphere).