7.2

CVSS Score

3.1

Basic Information

CVE ID

CVE-2022-23043

GHSA ID

GHSA-6r86-2jm9-9mh4

EPSS Score

0.73463%

CWE

CWE-434

Published

2/25/2022

Updated

2/3/2023

KEV Status

Technology

PHP

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-23043

CVE-2022-23043: File upload restriction bypass in Zenario CMS

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.

(GitHub Advisory)

7.2

CVSS Score

3.1

Basic Information

CVE ID

CVE-2022-23043

GHSA ID

GHSA-6r86-2jm9-9mh4

EPSS Score

0.73463%

CWE

CWE-434

Published

2/25/2022

Updated

2/3/2023

KEV Status

Technology

PHP

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tribalsystems/zenario	composer	< 9.2.55826	9.2.55826

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

Z*n*rio *MS *.* *llows *n *ut**nti**t** **min us*r to *yp*ss t** *il* uplo** r*stri*tion *y *r**tin* * n*w '*il*/MIM* Typ*s' usin* t** '.p**r' *xt*nsion. T**n *n *tt**k*r **n uplo** * m*li*ious *il*, int*r**pt t** r*qu*st *n* ***n** t** *xt*nsion to

Reasoning

No *n*lysis *v*il**l*

7.2

Basic Information

Concerned about an active attack path?

CVE-2022-23043: File upload restriction bypass in Zenario CMS

7.2

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI