CVE-2023-7147

gopeak MasterLab User.php base64ImageContent unrestricted upload

Medium6.3EPSS 0.60%

Published: 29 Dec 2023
Updated: 2 Aug 2024
Reserved: 28 Dec 2023
Assigned by: VulDB

Description

A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.

Scores

CVSS scores of CVE-2023-7147, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	3.1	Medium6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDBCNA (assigner)	3.0	Medium6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDBCNA (assigner)	2.0	Medium6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.60% · top 51% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

CWE-434 Unrestricted Upload (opens in a new tab)All about CWE-434 and its CVEs

Affected products

gopeak · MasterLab
- affected 3.3.0
- affected 3.3.1
- affected 3.3.2
- affected 3.3.3
- affected 3.3.4
- affected 3.3.5
- affected 3.3.6
- affected 3.3.7
- affected 3.3.8
- affected 3.3.9
- affected 3.3.10

References (3)

https://vuldb.com/?id.249150 (opens in a new tab)vdb-entrytechnical-descriptionx_transferred
https://vuldb.com/?ctiid.249150 (opens in a new tab)signaturepermissions-requiredx_transferred
https://note.zhaoj.in/share/affd8cjn50HC (opens in a new tab)broken-linkx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-7147](https://trackcve.app/badge/CVE-2023-7147.svg)](https://trackcve.app/cve/CVE-2023-7147)

Record last updated 2 Aug 2024, 08:50 UTC.