CVE-2023-36255

EPSS 57.4%

Vexday Risk Score

30Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 57.4%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

01 Aug 2023Metasploit module available

03 Aug 2023Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.

Affected products

n/a · n/a

References

https://trovent.github.io/security-advisories/TRSA-2303-01/TRSA-2303-01.txt https://trovent.io/security-advisory-2303-01/https://www.eramba.org