CVE-2023-34207

CRITICAL

Easyuse Mailhunter Ultimate < 2023 - Unrestricted File Upload

Title source: rule

Description

Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive.

References (1)

Core 1

Core References

Third Party Advisory third-party-advisory

https://zuso.ai/Advisory/ZA-2023-04

Scores

CVSS v3 9.9

EPSS 0.0029

EPSS Percentile 52.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

easyuse/mailhunter_ultimate < 2023

Published Oct 17, 2023

Tracked Since Feb 18, 2026