CVE-2023-45878
Memory Safety in Gibbonedu Gibbon ≤ 25.0.01
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-45878 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Gibbonedu Gibbon. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
GibbonEdu Gibbon versions 25.0.1 and earlier contain an unauthenticated arbitrary file write vulnerability in the rubrics_visualise_saveAjax.phps endpoint. The script accepts base64-encoded content via the img parameter along with a user-controlled path value that is concatenated with the application's installation directory, writing the decoded data to an arbitrary location on disk. This flaw maps to CWE-787 and carries a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can supply a malicious PHP payload in the img parameter and a suitable path to drop a web shell or other executable file under the web root, resulting in remote code execution with the privileges of the web server process. No authentication or user interaction is required, and the gibbonPersonID parameter is accepted but not needed for exploitation.
The usd AG advisory USD-2023-0025 published at herolab.usd.de details the issue and confirms the affected endpoint behavior. The associated EPSS score has remained consistently high, reaching a peak of 0.9271 and currently sitting at 0.9256, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50143
Vulnerability Data
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter…
more
is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.