CVE-2023-28725
Critical
Description
General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March 2023. This is fixed in 20221118.48 and 20230120.44.
SeverityCritical
CVSS9.1
Exploit probability—
ProductGeneralbytes Crypto Application Server
PublishedMar 22, 2023
First seenMar 22, 2023
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| generalbytes crypto_application_server | 20230120 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.