PT-2023-20729 · Northern.Tech · Cfengine Enterprise

Ole Herman Elgesem · Publicado 2023-04-25 · Atualizado 2024-06-27 · CVE-2023-26560

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Northern.tech CFEngine Enterprise versions prior to 3.21.1

Description The issue allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials.

Recommendations For versions prior to 3.21.1, update to version 3.21.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Scheduled Reports feature until a patch is available.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2023-26560

ROSA-SA-2024-2436

Produtos afetados

Cfengine Enterprise

Referências · 11

• https://t.me/cibsecurity/62885 · Publicação no Telegram
• https://northern.tech · Nota
• https://cfengine.com/blog/2023/cve-2023-26560 · Aviso do Fabricante
• https://t.me/cvenotify/49080 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-38379 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2021-44215 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2021-44216 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-26560 · Nota de Segurança
• https://cfengine.com/blog/2022/cve-2021-44215-and-cve-2021-44216 · Nota
• https://osv.dev/vulnerability/CVE-2023-26560 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-36756 · Nota de Segurança