PT-2023-23789 · Alerton · Alerton Acm

Publicado 2023-06-28 · Atualizado 2024-08-02 · CVE-2023-3243

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions BCM-WEB version 3.3.X

Description An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack.

Recommendations Upgrade to a supported product such as Alerton ACM. As a temporary workaround, consider restricting access to the authenticating hash until a patch is available. Avoid using the poorly salted MD5 hash in the affected product until the issue is resolved.

Correção

Inadequate Encryption Strength

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-326

CWE-290

Identificadores relacionados

CVE-2023-3243

Produtos afetados

Alerton Acm

Referências · 5

• https://t.me/cibsecurity/65691 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3243 · Nota de Segurança
• https://t.me/cvenotify/88464 · Publicação no Telegram
• https://honeywell.com/us/en/product-security · Nota
• https://t.me/cvenotify/78021 · Publicação no Telegram