PT-2023-20007 · Unknown · Docmosis Tornado

Frycos · Publicado 2023-02-28 · Atualizado 2025-03-18 · CVE-2023-25264

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docmosis Tornado versions prior to 2.9.5

Description An issue allows an unauthenticated attacker to bypass the authentication check filter completely by introducing a specially crafted request with relative path segments.

Recommendations For versions prior to 2.9.5, update to version 2.9.5 or later to resolve the issue.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-25264

Produtos afetados

Docmosis Tornado

Referências · 6

• 🔥 https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html · Exploit
• https://t.me/cvenotify/115185 · Publicação no Telegram
• https://resources.docmosis.com/content/documentation/tornado-v2-9-5-release-notes · Nota
• https://t.me/cibsecurity/59109 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25264 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25264 · Aviso do Fabricante