Security readout for executives and security teams
Plain-English summary
Fernus Informatics LMS before version 23.04.03 can accept dangerous file uploads that may let an attacker run operating system commands or trigger server-side include injection. The CVSS 9.8 score reflects potential full compromise of confidentiality, integrity, and availability if a vulnerable system is exposed.
Executive priority
Treat this as an urgent remediation item if Fernus LMS is present, especially on internet-facing systems. The business risk is potential full server compromise, but available evidence does not prove active exploitation in the wild.
Technical view
CVE-2023-1728 is CWE-434 unrestricted upload of a dangerous file type in Fernus Informatics LMS before 23.04.03. The provided CVSS vector is network-accessible, low complexity, no privileges, and no user interaction, with high impact across confidentiality, integrity, and availability.
Likely exposure
Organizations running Fernus Informatics LMS versions before 23.04.03 are the likely exposure. The source bundle provides no CPEs, endpoint names, hosting model, or deployment prevalence, so asset identification must rely on internal inventories and vendor records.
Exploitation context
The source bundle does not confirm active exploitation, and KEV status is false. The risk remains serious because the scored attack path is unauthenticated, network reachable, and potentially enables command execution or SSI injection.
Researcher notes
Evidence is limited to CVE metadata and Turkish government advisory references. One referenced USOM link is tagged broken in the bundle. No affected CPEs, vulnerable endpoint details, exploit proof, or official mitigation text beyond the version boundary are provided.
Mitigation direction
- Identify all Fernus Informatics LMS deployments and record exact versions.
- Prioritize vendor-confirmed upgrade to 23.04.03 or newer where available.
- Restrict external access to LMS until remediation is complete.
- Review vendor or government advisory guidance before applying configuration mitigations.
- Monitor LMS hosts for unexpected file uploads or command execution indicators.
Validation and detection
- Confirm whether any LMS instance reports a version before 23.04.03.
- Check internet exposure for identified LMS hosts and portals.
- Review upload handling controls against vendor guidance.
- Inspect web server and application logs for suspicious uploads or SSI processing.
- Verify remediation by rechecking the installed LMS version after update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-1728 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9TR-CERTVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.usom.gov.tr/bildirim/tr-23-0194CVE reference, TR-CERT · government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0194CVE reference, TR-CERT · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.