Security readout for executives and security teams
Plain-English summary
NOSH at commit 4a5cfdb has an authenticated upload flaw in the practice logo feature. A logged-in remote user may bypass client-side checks and upload PHP code. Because NOSH is a health charting product, successful compromise could expose Protected Health Information and disrupt clinical operations.
Executive priority
Prioritize this for any healthcare environment running NOSH because compromise could expose PHI and affect system integrity. Urgency is high, but exact remediation depends on vendor or project guidance because the bundle does not name a fixed version.
Technical view
The CVE describes CWE-434 unrestricted file upload in NOSH 4a5cfdb. The vulnerable practice logo upload relies on bypassable client-side validation, allowing authenticated remote PHP code execution. CVSS 3.1 is 8.8, with low attack complexity and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where NOSH deployments based on commit 4a5cfdb, or related Docker/source builds, are reachable by authenticated users. The bundle lists affected vendor/product fields as n/a, so version scoping is incomplete.
Exploitation context
The source bundle does not identify CISA KEV listing or active exploitation. It does identify a public reference and describes authenticated remote code execution, so defenders should treat internet-accessible or broadly user-accessible deployments as urgent to validate.
Researcher notes
The CVE data is strong on vulnerability class and impact but weak on product/version metadata. Treat 4a5cfdb as the confirmed affected code point and avoid expanding affected scope without repository or vendor evidence.
Mitigation direction
- Check NOSH project or vendor guidance for a fixed build or official mitigation.
- Inventory NOSH source and Docker deployments for commit 4a5cfdb exposure.
- Restrict NOSH access to trusted networks and necessary authenticated users.
- Review upload handling for server-side file type, extension, and execution controls.
- Monitor for suspicious uploads and unexpected PHP files in web-accessible locations.
Validation and detection
- Confirm whether any deployment uses NOSH commit 4a5cfdb or derived Docker images.
- Identify users or roles that can access the practice logo upload feature.
- Review application and web server logs for unusual logo upload activity.
- Check web-accessible upload directories for unexpected executable PHP content.
- Validate that uploaded files cannot execute as server-side code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-24610 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/shihjay2/docker-noshCVE reference
- https://noshemr.wordpress.com/CVE reference
- https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533CVE reference
- https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54aCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.