PT-2023-22416 · Abstrium · Abstrium Pydio Cells

Ignatiusmichael · Publicado 2023-05-30 · Atualizado 2024-08-20 · CVE-2023-2978

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Abstrium Pydio Cells version 4.2.0

Description A vulnerability was found in the component Change Subscription Handler, which leads to authorization bypass. The manipulation of this component can be exploited, and it has been disclosed to the public. Upgrading to version 4.2.1 is able to address this issue.

Recommendations For Abstrium Pydio Cells version 4.2.0, upgrade to version 4.2.1 to address the issue. As a temporary workaround, consider restricting access to the Change Subscription Handler component until the upgrade is applied.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-2978

GHSA-MV7X-27PC-8C96

GO-2023-1808

Produtos afetados

Abstrium Pydio Cells

Referências · 11

• 🔥 https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be · Exploit
• https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 · Correção
• https://github.com/advisories/GHSA-mv7x-27pc-8c96 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2978 · Nota de Segurança
• https://vuldb.com/?ctiid.230210 · Nota
• https://t.me/cvenotify/51360 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2978 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mv7x-27pc-8c96 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1808 · Aviso do Fabricante
• https://t.me/cvenotify/51775 · Publicação no Telegram
• https://vuldb.com/?id.230210 · Nota