PT-2023-20970 · Tsplus · Tsplus Remote Work

CVE-2023-27132 · Publicado 2023-10-17 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TSplus Remote Work version 16.0.0.0

Description The issue concerns the storage of a cleartext password in the HTML source code of the secure single sign-on web portal. Specifically, the password is placed on the var pass line.

Recommendations For TSplus Remote Work version 16.0.0.0, consider modifying the code to securely store passwords, avoiding cleartext storage in the HTML source code. As a temporary workaround, restrict access to the secure single sign-on web portal to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2023-27132

Produtos afetados

Tsplus Remote Work

Referências · 8

• 🔥 https://packetstormsecurity.com/files/174271 · Exploit
• https://osv.dev/vulnerability/CVE-2023-27132 · Aviso do Fabricante
• https://t.me/cvenotify/59613 · Publicação no Telegram
• https://t.me/cvenotify/59932 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1714351056224649535 · Publicação no Twitter
• https://t.me/cibsecurity/72444 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1714308642223349865 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-27132 · Nota de Segurança