PT-2023-2207 · Oracle+1 · Java Rmi Interface+1

Publicado

2023-04-11

·

Atualizado

2023-04-28

·

CVE-2023-29411

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions APC Easy UPS Online Monitoring Software versions (affected versions not specified) Java RMI interface versions (affected versions not specified)
Description The issue is related to a lack of authentication for a critical function, which could allow an attacker to change administrative credentials, potentially leading to remote code execution without prior authentication on the Java RMI interface.
Recommendations For APC Easy UPS Online Monitoring Software, update the software to a version that includes authentication for critical functions. For Java RMI interface, restrict access to the interface until a patch is available that includes proper authentication for critical functions. As a temporary workaround, consider disabling the updateManagerPassword function until a patch is available.

Correção

Missing Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2023-01954
CVE-2023-29411
ZDI-23-444

Produtos afetados

Apc Easy Ups Online Monitoring
Java Rmi Interface