PT-2023-23285 · Unknown · Sesami Cash Point & Transport Optimizer

Marcus Nilsson · Publicado 2023-12-28 · Atualizado 2024-01-08 · CVE-2023-31299

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6

Description The issue allows remote attackers to execute arbitrary code via the Barcode field of a container. This is a Cross Site Scripting (XSS) vulnerability.

Recommendations For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the Barcode field functionality until a patch is available to prevent exploitation. Restrict access to the container's Barcode field to minimize the risk of arbitrary code execution. Avoid using the Barcode field in the affected container until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-31299

Produtos afetados

Sesami Cash Point & Transport Optimizer

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-31299 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31299 · Nota de Segurança
• https://twitter.com/CVEnew/status/1740592919558463757 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1740623031611867275 · Publicação no Twitter
• https://herolab.usd.de/en/security-advisories/usd-2022-0055 · Nota
• https://t.me/cvenotify/66585 · Publicação no Telegram
• https://t.me/cibsecurity/73899 · Publicação no Telegram
• https://t.me/cvenotify/65598 · Publicação no Telegram