PT-2023-20211 · Unknown · Zxcloud Irai

Publicado 2023-12-14 · Atualizado 2023-12-19 · CVE-2023-25650

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZXCLOUD iRAI (affected versions not specified)

Description There is an issue where an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads. This is due to the backend not escaping special strings or restricting paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-25650

Produtos afetados

Zxcloud Irai

Referências · 6

• https://t.me/cvenotify/63636 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25650 · Nota de Segurança
• https://t.me/cvenotify/64226 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25650 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1735196558025453767 · Publicação no Twitter
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032904 · Aviso do Fabricante