CVE-2023-32637: 
Linux Debian vulnerability analysis and mitigation

GBrowse, a web-based genome browser provided by Generic Model Organism Database Project, contains a critical file upload vulnerability identified as CVE-2023-32637. The vulnerability was discovered and reported by Cyber Defense Institute, Inc., and was assigned on May 11, 2023. The issue affects GBrowse version 1.70, while version 2.56 implements restrictions on non-GFF formatted file uploads (JVN Advisory).

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). GBrowse accepts files with any format and places them in an area accessible through unauthenticated web requests. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (NVD).

The vulnerability allows anyone who can upload files through the product to execute arbitrary code on the server. The attack vector is network-accessible, requires no privileges or user interaction, and can result in complete compromise of system confidentiality, integrity, and availability (JVN Advisory).

The developers recommend discontinuing the use of GBrowse as it is no longer supported. Users are advised to switch to the successor product JBrowse2, which is actively maintained and provides improved security features (JVN Advisory).