PT-2023-21724 · Unknown · Smartcars 3

Jishwaah · Publicado 2023-03-23 · Atualizado 2023-03-28 · CVE-2023-28441

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions smartCARS 3 versions 0.5.8 and prior

Description The issue affects smartCARS 3, a flight tracking software. In the affected versions, failed login attempts result in passwords being stored in error logs. This does not occur in version 0.5.9.

Recommendations For versions 0.5.8 and prior, as a workaround, delete the affected log file and ensure correct login to prevent password storage in error logs. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is known that version 0.5.9 does not have this problem.

Exploit

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2023-28441

GHSA-FP42-C8G2-5JC7

Produtos afetados

Smartcars 3

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28441.json · Exploit
• https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-fp42-c8g2-5jc7 · Aviso do Fabricante
• https://t.me/cibsecurity/60636 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28441 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28441 · Nota de Segurança