PT-2023-19295 · Softwarex · Softwarex

F0Ns1 · Publicado 2023-03-10 · Atualizado 2023-03-16 · CVE-2023-23911

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to v6

Description An improper access control issue exists that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.

Recommendations For versions prior to v6, update to version v6 or later to resolve the issue. As a temporary workaround, consider restricting user permissions to change the group key of a chat room until a patch is available.

Correção

Inadequate Encryption Strength

Improper Access Control

Enumeração de Fraquezas

CWE-326

CWE-284

Identificadores relacionados

CVE-2023-23911

Produtos afetados

Softwarex

Referências · 5

• https://t.me/cibsecurity/59855 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23911 · Nota
• https://hackerone.com/reports/1757663 · Nota
• https://osv.dev/vulnerability/CVE-2023-23911 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23911 · Nota de Segurança