PT-2023-21240 · Taphome · Taphome

Noam Moshe · CVE-2023-2760 · Publicado 2023-07-17 · Atualizado 2023-08-09

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions TapHome versions prior to 2023.2

Description An SQL injection issue exists in the HandleMessageUpdateDevicePropertiesRequest function, allowing low-privileged users to inject arbitrary SQL directives into an SQL query. This enables the execution of arbitrary SQL commands, providing full reading access, and may also lead to limited write access and temporary Denial-of-Service.

Recommendations For versions prior to 2023.2, update to version 2023.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the HandleMessageUpdateDevicePropertiesRequest function until a patch is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-2760

Produtos afetados

Taphome

Referências · 6

• https://claroty.com/team82/disclosure-dashboard/cve-2023-2759 · Nota
• https://t.me/cvenotify/54470 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2760 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-2760 · Aviso do Fabricante
• https://t.me/cvenotify/56072 · Publicação no Telegram
• https://t.me/cibsecurity/66803 · Publicação no Telegram