VULNERABILITY INTELLIGENCE
CVE-2022-38843
CVSS score8.8 HIGH
EPSS probability1.35%
CISA KEVNot currently listed
Published2022-09-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.
Weakness classification
- nvd@nist.gov: CWE-434
Primary references
- cve@mitre.org — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory