PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-3375 Unisign CVE debrief

CVE-2023-3375 is a high-severity vulnerability in Bookreen versions before 3.0.0. The issue is described as an unrestricted upload of a file with a dangerous type that can lead to OS command injection. NVD rates the issue at CVSS 3.1 7.2 with network attack vector, low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability, but with high privileges required.

Vendor
Unisign
Product
Bookreen
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2023-09-05
Original CVE updated
2024-11-21
Advisory published
2023-09-05
Advisory updated
2024-11-21

Who should care

Organizations running Bookreen before 3.0.0 should treat this as a priority issue, especially where privileged users can upload files or where uploaded content is processed by server-side jobs. Security teams, application owners, and administrators responsible for file-upload workflows should review exposure and upgrade plans.

Technical summary

The published data identifies CWE-434, unrestricted upload of file with dangerous type, as the weakness class. The affected CPE is cpe:2.3:a:bookreen:bookreen:*:*:*:*:*:*:*:* with vulnerability ending before 3.0.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable issue that still requires high privileges. The source corpus does not provide patch details, exploit prerequisites beyond the CVSS privileges requirement, or remediation steps beyond the affected version boundary.

Defensive priority

High. The affected version range is clearly bounded, the impact is severe, and the attack path can affect server-side execution. However, the need for high privileges slightly narrows exposure compared with low-privilege remote flaws, so the main focus should be on privileged upload paths and rapid upgrade to 3.0.0 or later.

Recommended defensive actions

  • Confirm whether any Bookreen instances are running versions before 3.0.0.
  • Upgrade Bookreen to 3.0.0 or later if still supported.
  • Review and restrict who can access file-upload functionality, especially privileged or administrative roles.
  • Validate server-side upload controls to reject dangerous file types and enforce allowlists rather than blocklists.
  • Inspect application logging and upload handling for unexpected file types or anomalous server-side behavior.
  • If an affected instance cannot be upgraded immediately, reduce exposure by limiting upload features and monitoring privileged accounts closely.

Evidence notes

This debrief is based on the official CVE record and NVD detail for CVE-2023-3375, plus the referenced USOM advisory. The corpus explicitly states the affected range as Bookreen before 3.0.0, the weakness class as CWE-434, and the CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The source material does not include exploit steps, proof-of-concept code, or detailed vendor remediation guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-3375 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-3375

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-3375 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-3375

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.