PT-2023-22593 · 4D · 4D Server Application

Karlo Dautović · Publicado 2023-06-16 · Atualizado 2023-12-14 · CVE-2023-30222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 4D Server Application versions v17 through v19 R7

Description An information disclosure issue allows attackers to retrieve password hashes for all users via eavesdropping.

Recommendations For versions v17 through v19 R7, update to a version later than v19 R7 to resolve the issue.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2023-30222

Produtos afetados

4D Server Application

Referências · 6

• 🔥 https://infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server · Exploit
• https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure · Nota
• https://t.me/cvenotify/63609 · Publicação no Telegram
• https://packetstormsecurity.com · Nota
• https://osv.dev/vulnerability/CVE-2023-30222 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30222 · Nota de Segurança