CVE-2023-46694
Published: 28 May 2024
Summary
CVE-2023-46694 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vtenext version 21.02 contains an unrestricted file upload vulnerability tracked as CVE-2023-46694 and assigned CWE-434. The flaw stems from missing authentication checks on the Ckeditor file manager component, which permits an authenticated user to upload arbitrary files that can subsequently be used for remote command execution. The issue carries a CVSS 3.1 base score of 8.1 reflecting network attack vector, low complexity, and low-privileged access requirements.
An authenticated attacker with network access can exploit the weakness to upload malicious files and achieve code execution on the server, resulting in high impact to confidentiality and integrity while leaving availability unaffected. The EPSS score has remained flat at 0.0908 with no material increase since disclosure.
Public references consist of GitHub repositories that document the issue but provide no official vendor advisory or patch information. No evidence of widespread exploitation or additional context such as AI/ML involvement appears in the supplied data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50881
Vulnerability details
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckeditor file manager functionality.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.