PT-2023-23324 · Evasys · Evasys

Dipl-Ing. Mario Rubak + 1 · Publicado 2023-05-02 · Atualizado 2023-05-10 · CVE-2023-31435

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions evasys versions prior to 8.2 Build 2286 evasys versions 9.x prior to 9.0 Build 2401

Description The issue allows authenticated attackers to read and write to unauthorized data by accessing functions directly in multiple components, including Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews.

Recommendations For evasys versions prior to 8.2 Build 2286, update to version 8.2 Build 2286 or later. For evasys versions 9.x prior to 9.0 Build 2401, update to version 9.0 Build 2401 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-31435

Produtos afetados

Evasys

Referências · 5

• 🔥 https://cves.at/posts/cve-2023-31435/writeup · Exploit
• https://osv.dev/vulnerability/CVE-2023-31435 · Aviso do Fabricante
• https://t.me/cibsecurity/63186 · Publicação no Telegram
• https://t.me/cvenotify/50115 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31435 · Nota de Segurança