Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token parameter to upload a malicious JSP file into a web-accessible directory and then request it to achieve remote code execution as the web-server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2023-54405 hits H3C's CVM, CVSS 9.8. An unauthenticated attacker manipulates the token parameter on its upload endpoint to traverse directories and plant a malicious JSP file, then requests it for remote code execution as the web server, no login needed. VulnTracker recommends upgrading CVM to the latest build now, exploitation evidence dates back to 2023. Details: http://vulntracker.io/cves/CVE-2023-54405 #H3C #CVM #CVE #InfoSec
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2023-54405 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-02 A critical vulnerability (Unrestricted Upload of File with Dangerous Type) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown