PT-2023-21225 · Maddy · Maddy

Foxcpp · Publicado 2023-03-13 · Atualizado 2024-08-20 · CVE-2023-27582

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions maddy versions 0.2.0 through 0.6.2

Description The issue allows for a full authentication bypass if a SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username.

Recommendations For versions 0.2.0 through 0.6.2, upgrade to version 0.6.3 to resolve the issue. As a temporary workaround, consider disabling the use of the PLAIN authentication mechanisms until a patch is available. Restrict access to the SASL authorization username to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-305

Identificadores relacionados

CVE-2023-27582

GHSA-4G76-W3XW-2X6W

GO-2023-1630

Produtos afetados

Maddy

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27582.json · Exploit
• https://github.com/foxcpp/maddy · Nota
• https://github.com/foxcpp/maddy/security/advisories/GHSA-4g76-w3xw-2x6w · Aviso do Fabricante
• https://github.com/foxcpp/maddy/commit/55a91a37b71210f34f98f4d327c30308fe24399a · Correção
• https://github.com/foxcpp/maddy/releases/tag/v0.6.3 · Nota
• https://github.com/foxcpp/maddy/commit/9f58cb64b39cdc01928ec463bdb198c4c2313a9c · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-27582 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27582 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4g76-w3xw-2x6w · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1630 · Aviso do Fabricante