PT-2023-22446 · Senayan · Slims

Rahad Chowdhury · Publicado 2023-04-14 · Atualizado 2023-04-25 · CVE-2023-29850

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SENAYAN Library Management System (SLiMS) Bulian version 9.5.2

Description The issue allows attackers to obtain information such as the user's geolocation and device information because the system does not strip exif data from uploaded images.

Recommendations For version 9.5.2, consider removing or stripping exif data from uploaded images to prevent information disclosure. As a temporary workaround, restrict image uploads until a proper fix is implemented.

Exploit

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2023-29850

Produtos afetados

Slims

Referências · 5

• 🔥 https://github.com/slims/slims9_bulian/issues/186 · Exploit
• https://t.me/cvenotify/49037 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-29850 · Aviso do Fabricante
• https://t.me/cibsecurity/62149 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29850 · Nota de Segurança