CVE-2023-43176 : A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attacke

A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.

Published 2023-10-03 21:15:10

Updated 2023-10-05 16:47:04

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-43176

Afterlogic » Aurora Files » Version: 9.7.3
cpe:2.3:a:afterlogic:aurora_files:9.7.3:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.37%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Assigned by: nvd@nist.gov (Primary)

http://afterlogic.com

AfterLogic Corp. — mail server, webmail client, email components
Product
https://sec.leonardini.dev/blog/cve-2023-43176-rce_aurora_files/

CVE-2023-43176: Remote Code Execution on Aurora Files <= 9.7.3
Exploit;Patch;Third Party Advisory
http://aurora.com

Broken Link;Not Applicable
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H&version=3.1

NVD - CVSS v3 Calculator
Third Party Advisory;US Government Resource;VDB Entry

Jump to