CVE-2022-29623

Description

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report.

References

https://www.youtube.com/watch?v=i3xJR-91rrM

https://www.npmjs.com/package/connect-multiparty

https://github.com/expressjs/connect-multiparty/releases/tag/2.2.0

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS