CVE-2023-1728

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1728
Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0194
https://www.usom.gov.tr/bildirim/tr-23-0194 Third Party Advisory US Government Resource
https://www.usom.gov.tr/bildirim/tr-23-0194 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:fernus:learning_management_systems:*:*:*:*:*:*:*:*
History

22 May 2026, 14:16

Type Values Removed Values Added
Summary (en) Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection.This issue affects LMS: before 23.04.03. (en) Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.
References
  • () https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0194 -

21 Nov 2024, 07:39

Type Values Removed Values Added
References () https://www.usom.gov.tr/bildirim/tr-23-0194 - Third Party Advisory, US Government Resource () https://www.usom.gov.tr/bildirim/tr-23-0194 - Third Party Advisory, US Government Resource

17 Apr 2023, 08:15

Type Values Removed Values Added
Summary Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection.This issue affects LMS: before 23.04.03. Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection.This issue affects LMS: before 23.04.03.

09 Apr 2023, 03:26

Type Values Removed Values Added
CPE cpe:2.3:a:fernus:learning_management_systems:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 10.0 		v2 : unknown
v3 : 9.8
First Time Fernus
Fernus learning Management Systems
References (MISC) https://www.usom.gov.tr/bildirim/tr-23-0194 - (MISC) https://www.usom.gov.tr/bildirim/tr-23-0194 - Third Party Advisory, US Government Resource

04 Apr 2023, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-04 09:15

Updated : 2026-05-22 14:16

NVD link : CVE-2023-1728

Mitre link : CVE-2023-1728

CVE.ORG link : CVE-2023-1728

JSON object : View

Products Affected

fernus

  • learning_management_systems
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type