PT-2023-17438 · Datagear · Datagear

Yangyanglo · Publicado 2023-04-14 · Atualizado 2024-09-16 · CVE-2023-2042

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataGear versions up to 4.7.0/5.1.0

Description A problematic issue has been found in the JDBC Server Handler component of DataGear, allowing for deserialization through manipulation. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond.

Recommendations For versions up to 4.7.0/5.1.0, consider disabling the JDBC Server Handler component until a patch is available. Restrict access to the component to minimize the risk of exploitation. Avoid using the affected functionality of the JDBC Server Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2023-2042

Produtos afetados

Datagear

Referências · 10

• 🔥 https://github.com/yangyanglo/ForCVE/blob/main/2023-0x06.md · Exploit
• https://vuldb.com/?submit.109292 · Nota
• https://t.me/cvenotify/94747 · Publicação no Telegram
• https://vuldb.com/?id.225920 · Nota
• https://osv.dev/vulnerability/CVE-2023-2042 · Aviso do Fabricante
• https://t.me/cibsecurity/62118 · Publicação no Telegram
• https://t.me/cvenotify/48214 · Publicação no Telegram
• https://vuldb.com/?ctiid.225920 · Nota
• https://t.me/cvenotify/48220 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2042 · Nota de Segurança