CVE-2023-33831

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

22.71% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-77

Published

2023-09-18

Updated

2024-09-25

Proof-of-concept exploits (2)

• btar1gan/exploit_CVE-2023-338310★ · 2024-09-13
• rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-3383113★ · 2024-10-27

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33831.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2023/CVE-2023-33831.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-24112
• CVE-2022-35914
• CVE-2023-0297
• CVE-2023-27163
• CVE-2024-39205
• CVE-2017-5941