CVE-2023-50090

Published: Jan 3, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.

Affected (1)

Products: Ureport2 Project: Ureport2

Ureport2 Project

1 product

Ureport2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ureport2 Project Ureport2	Up to 2.2.9

References (3)

https://lemono.fun/thoughts/UReport2-RCE.html

Source: cve@mitre.org

Broken Link

https://github.com/advisories/GHSA-445x-c8qq-qfr9

Source: nvd@nist.gov

Third Party Advisory

https://lemono.fun/thoughts/UReport2-RCE.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.