PT-2023-13352 · Rws · Rws Worldserver

Brecht Snijders + 1 · Publicado 2023-12-25 · Atualizado 2024-01-04 · CVE-2022-34267

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RWS WorldServer versions prior to 11.7.3

Description An issue was discovered in RWS WorldServer where adding a token parameter with the value of 02 bypasses all authentication requirements. This allows arbitrary Java code to be uploaded and executed via a .jar archive to the "ws-api/v2/customizations/api" endpoint.

Recommendations For versions prior to 11.7.3, update to version 11.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "ws-api/v2/customizations/api" endpoint until a patch is available. Avoid using the token parameter with the value of 02 in the affected API endpoint until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2022-34267

Produtos afetados

Rws Worldserver

Referências · 8

• 🔥 https://triskelelabs.com/vulnerabilities-in-rws-worldserver · Exploit
• https://rws.com/localization/products/trados-enterprise/worldserver · Nota
• https://osv.dev/vulnerability/CVE-2022-34267 · Aviso do Fabricante
• https://t.me/cvenotify/66142 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-34267 · Nota de Segurança
• https://twitter.com/RedPacketSec/status/1740312276450586785 · Publicação no Twitter
• https://t.me/cvenotify/65099 · Publicação no Telegram
• https://twitter.com/Esparta6108713/status/1739202089040109973 · Publicação no Twitter