critical9.8
CVE-2022-41711
Badaso vulnerable to Remote Code Execution via malicious file upload
Impact
Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | badaso/core | < 2.6.1 | 2.6.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Uatech | Badaso | Version 2.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://fluidattacks.com/advisories/harlow/
- https://github.com/uasoft-indonesia/badaso/issues/802
- https://github.com/advisories/GHSA-fwvc-9xhj-26v5
- https://nvd.nist.gov/vuln/detail/CVE-2022-41711
- https://github.com/uasoft-indonesia/badaso/commit/22250eca7c364d991ce9e0a723941eae4889d6f9