---
cve: "CVE-2023-48376"
severity: "CRITICAL"
cvss: 9.8
epss: "1%"
vendor: "SmartStar Software"
kev: false
exploited: false
published: "2023-12-15 07:52:31"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-28T20:11:09+01:00"
---

# CVE-2023-48376

> 9.8 CRITICAL

## Beschreibung

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.

## CNA-Record (Kanon, cvelistV5)

- CNA: **twcert**
- State: PUBLISHED
- Stand: 2024-08-02 21:30:34
- CNA-CVSS: **9.8** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-434** — Unrestricted Upload of File with Dangerous Type
  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)

## Referenzen

- <https://www.twcert.org.tw/tw/cp-132-7595-d58b1-1.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2023-48376/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_