PT-2023-23162 · Effectindex · Tripreporter

5Ht2 · Publicado 2023-05-08 · Atualizado 2023-05-15 · CVE-2023-31123

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions effectindex/tripreporter versions prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b

Description The issue concerns an improper password verification vulnerability. This vulnerability allows any user with a password matching the password requirements to log in as any user, potentially leading to access to accounts and data loss of the user.

Recommendations For versions prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, update to this commit or newer as soon as possible. As a temporary workaround, someone running their own instance may apply the patch manually.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-31123

GHSA-356R-RWP8-H6M6

Produtos afetados

Tripreporter

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31123.json · Exploit
• https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-h6m6 · Aviso do Fabricante
• https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e29874296c8729dd53b · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-31123 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31123 · Aviso do Fabricante
• https://t.me/cvenotify/50004 · Publicação no Telegram