PT-2023-20167 · Apollo · Apollo

Nobodyiam · Publicado 2023-02-20 · Atualizado 2023-03-01 · CVE-2023-25569

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apollo versions prior to 2.1.0

Description A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. The issue is related to the Cookie SameSite strategy, which was set to Lax in version 2.1.0.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, avoid visiting unknown source pages to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-25569

GHSA-FMXQ-V8MG-QH25

Produtos afetados

Apollo

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25569.json · Exploit
• https://github.com/apolloconfig/apollo · Nota
• https://github.com/apolloconfig/apollo/pull/4664 · Correção
• https://github.com/apolloconfig/apollo/releases/tag/v2.1.0 · Nota
• https://github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750 · Correção
• https://github.com/apolloconfig/apollo/security/advisories/GHSA-fmxq-v8mg-qh25 · Nota
• https://t.me/cvenotify/44683 · Publicação no Telegram
• https://apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25569 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25569 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fmxq-v8mg-qh25 · Aviso do Fabricante
• https://t.me/cibsecurity/58526 · Publicação no Telegram