PT-2023-21161 · Unknown · Thmmniii/Fbs-Core

Mxsph · Publicado 2023-03-07 · Atualizado 2023-03-14 · CVE-2023-27485

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions thmmniii/fbs-core versions prior to 1.5.3

Description thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3, when querying subresults, it is possible to query subresults from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user.

Recommendations For versions prior to 1.5.3, upgrade to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the subresults query for logged-in users until the upgrade is applied.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-27485

GHSA-FHQ8-P3W6-MMGR

Produtos afetados

Thmmniii/Fbs-Core

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27485.json · Exploit
• https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-fhq8-p3w6-mmgr · Correção
• https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.5.3 · Nota
• https://github.com/thm-mni-ii/feedbacksystem/commit/f1ae67d8bb2286a8eb15949038473d41b1358493 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-27485 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27485 · Aviso do Fabricante
• https://thm-mni-ii.github.io/feedbacksystem/api-docs/#tag/Submission/operation/getCourseTaskSubmissionSubresults · Nota
• https://t.me/cibsecurity/59615 · Publicação no Telegram
• https://t.me/cvenotify/45763 · Publicação no Telegram