PT-2023-23284 · Unknown · Sesami Cash Point & Transport Optimizer

Marcus Nilsson · Publicado 2023-12-28 · Atualizado 2024-01-04 · CVE-2023-31298

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6

Description The issue allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user. This is a Cross Site Scripting (XSS) vulnerability.

Recommendations For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the creation of new system users until a patch is available to prevent exploitation via the User ID field. Avoid using the User ID field in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-31298

Produtos afetados

Sesami Cash Point & Transport Optimizer

Referências · 5

• https://twitter.com/CVEnew/status/1740556508361028094 · Publicação no Twitter
• https://t.me/cibsecurity/73862 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31298 · Nota de Segurança
• https://herolab.usd.de/en/security-advisories/usd-2022-0060 · Nota
• https://osv.dev/vulnerability/CVE-2023-31298 · Aviso do Fabricante