CVE-2023-24610

moderate-risk
Published 2023-02-01

NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting.

Do I need to act?

!
16.7% chance of exploitation in next 30 days
EPSS score — higher than 83% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Nosh Chartingsystem Project

References (8)

Third Party Advisory https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a
Product https://github.com/shihjay2/docker-nosh
Product https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533
Third Party Advisory https://noshemr.wordpress.com
Third Party Advisory https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a
Product https://github.com/shihjay2/docker-nosh
Product https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533
Third Party Advisory https://noshemr.wordpress.com
48
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 13/34 · Low
Exposure 5/34 · Minimal