CVE-2023-38941
Published: 04 August 2023
Summary
CVE-2023-38941 is a critical-severity Command Injection (CWE-77) vulnerability in Ehco1996 Django-Sspanel. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-38941 is a remote command execution vulnerability in django-sspanel version 2022.2.2. The flaw resides in the GoodsCreateView._post method within the sspanel/admin_view.py component and is tracked under CWE-77. It received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated attacker can send a crafted request to the affected endpoint and execute arbitrary operating-system commands on the server. Successful exploitation grants full control over the application and underlying host, including the ability to read, modify, or delete data and potentially pivot within the environment.
The associated EPSS score has remained flat at 0.069 with no material increase since disclosure, indicating limited observed exploitation interest to date. The only public references point to the project's GitHub repository, which contains no published patches or mitigation guidance in the supplied data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-42701
Vulnerability details
django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._post.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.