CVE-2023-49257

Summary

CVE-2023-49257 is a newly disclosed vulnerability that allows authenticated users to upload arbitrary CGI-compatible files using the certificate upload utility. Once uploaded, these files can be executed with root user privileges, posing a significant security risk. An attacker can exploit this vulnerability to gain unauthorized access to sensitive information or take control of the affected system. The certificate upload utility, which is intended for secure certificate management, unfortunately fails to adequately restrict file types or enforce proper access controls, making it vulnerable to this attack. System administrators are advised to patch affected systems as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.