What is CVE-2013-3631?

CVE-2013-3631 is a vulnerability in Nas4free, classified under Code Injection. Published 2013-11-02.

Is CVE-2013-3631 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Nas4free

CVE-2013-3631

NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.137 (96.1th percentile) — read the EPSS interpretation.

Affected products

Nas4free — versions 9.1.0.1.798
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

rapid7/metasploit-framework

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
cret@cert.org (Exploit, x_refsource_MISC)

Frequently asked questions

What is CVE-2013-3631?: CVE-2013-3631 is a vulnerability in Nas4free, classified under Code Injection. Published 2013-11-02.
Is CVE-2013-3631 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.