PT-2023-23279 · Unknown · Sesami Cash Point & Transport Optimizer

Marcus Nilsson · Publicado 2023-12-28 · Atualizado 2024-01-08 · CVE-2023-31293

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6

Description An issue was discovered that allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option being disabled.

Recommendations For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the Reader system user's web browser access to the journal as a temporary workaround until a patch is available. Restrict access to the journal to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2023-31293

Produtos afetados

Sesami Cash Point & Transport Optimizer

Referências · 6

• https://t.me/cvenotify/66583 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31293 · Nota de Segurança
• https://herolab.usd.de/en/security-advisories/usd-2022-0061 · Nota
• https://t.me/cibsecurity/73876 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31293 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1740561145348456885 · Publicação no Twitter