PT-2023-22421 · Abstrium · Abstrium Pydio Cells

Ignatiusmichael · Publicado 2023-05-30 · Atualizado 2024-08-21 · CVE-2023-2980

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Abstrium Pydio Cells version 4.2.0

Description A critical vulnerability was found in the User Creation Handler component, leading to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue.

Recommendations For Abstrium Pydio Cells version 4.2.0, upgrade to version 4.2.1 to address the issue. As a temporary workaround, consider restricting access to the User Creation Handler component until the upgrade is applied.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

CWE-99

Identificadores relacionados

CVE-2023-2980

GHSA-J327-C69H-4GH8

GO-2023-2344

Produtos afetados

Abstrium Pydio Cells

Referências · 12

• 🔥 https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be · Exploit
• https://github.com/pydio/cells · Nota
• https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 · Correção
• https://t.me/cvenotify/51369 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-2344 · Aviso do Fabricante
• https://github.com/advisories/GHSA-j327-c69h-4gh8 · Nota
• https://vuldb.com/?id.230212 · Nota
• https://osv.dev/vulnerability/CVE-2023-2980 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2980 · Nota de Segurança
• https://vuldb.com/?ctiid.230212 · Nota
• https://osv.dev/vulnerability/GHSA-j327-c69h-4gh8 · Aviso do Fabricante
• https://t.me/cvenotify/51776 · Publicação no Telegram