PT-2023-19740 · Unknown · Mojoportal

Blakduk · Publicado 2023-02-09 · Atualizado 2025-03-24 · CVE-2023-24689

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mojoportal versions 2.7.0.0 and below

Description The issue allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the s parameter in "/DesignTools/ManageSkin.aspx".

Recommendations For versions 2.7.0.0 and below, consider restricting access to the "/DesignTools/ManageSkin.aspx" endpoint until a patch is available. As a temporary workaround, avoid using the s parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-24689

Produtos afetados

Mojoportal

Referências · 8

• 🔥 https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-24689 · Aviso do Fabricante
• https://t.me/cibsecurity/57874 · Publicação no Telegram
• https://mojoportal.com · Nota
• https://t.me/cvenotify/44033 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-24689 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24689 · Nota
• https://t.me/cvenotify/115964 · Publicação no Telegram