PT-2023-16568 · Netmodule · Netmodule Nsrw

Quentin Kaiser · Publicado 2023-02-16 · Atualizado 2024-09-12 · CVE-2023-0862

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetModule NSRW versions 4.3.0.0 through 4.3.0.118 NetModule NSRW versions 4.4.0.0 through 4.4.0.117 NetModule NSRW versions 4.6.0.0 through 4.6.0.104 NetModule NSRW versions 4.7.0.0 through 4.7.0.102

Description The NetModule NSRW web administration interface is susceptible to path traversal attacks. This could allow authenticated users to upload arbitrary files to the web root directory, potentially leading to remote command execution with elevated privileges.

Recommendations For versions 4.3.0.0 through 4.3.0.118, update to version 4.3.0.119 or later. For versions 4.4.0.0 through 4.4.0.117, update to version 4.4.0.118 or later. For versions 4.6.0.0 through 4.6.0.104, update to version 4.6.0.105 or later. For versions 4.7.0.0 through 4.7.0.102, update to version 4.7.0.103 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-0862

Produtos afetados

Netmodule Nsrw

Referências · 9

• https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities · Nota
• https://t.me/cibsecurity/72746 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0862 · Nota de Segurança
• https://t.me/cibsecurity/58308 · Publicação no Telegram
• https://t.me/cvenotify/59920 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0862 · Aviso do Fabricante
• https://t.me/cvenotify/44452 · Publicação no Telegram
• https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf · Aviso do Fabricante
• https://t.me/cvenotify/94425 · Publicação no Telegram