Compuware iStrobe Web 20.13 contains an unrestricted file upload vulnerability (CWE-434) that permits unauthenticated remote attackers to upload JSP files via a path traversal attack on the 'fileName' parameter in the file upload form. This leads to remote code execution by allowing execution of arbitrary commands through the uploaded JSP web shell. The vulnerability is exploitable over the network without authentication and requires no user interaction, making it highly critical.

An attacker can remotely execute arbitrary code on the vulnerable system without authentication by uploading a malicious JSP web shell. This can lead to full system compromise, unauthorized access, data theft, or disruption of service. The vulnerability affects Compuware iStrobe Web 20.13 and has a CVSS score of 9.2, reflecting its critical impact and high exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the affected application, disable or restrict file upload functionality if possible, and monitor for suspicious file uploads or web shell activity. Follow vendor updates closely for an official fix.