PT-2023-24615 · Briar · Briar

Kenny Paterson + 1 · Publicado 2023-05-24 · Atualizado 2025-01-16 · CVE-2023-33981

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Briar versions prior to 1.4.22

Description The issue allows attackers to spoof other users' messages in a blog, forum, or private group. However, each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one.

Recommendations For versions prior to 1.4.22, update to version 1.4.22 or later to resolve the issue. As a temporary workaround, consider implementing additional message validation to detect and prevent spoofed messages. Restrict access to sensitive areas of the blog, forum, or private group to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-354

Identificadores relacionados

CVE-2023-33981

Produtos afetados

Briar

Referências · 7

• 🔥 https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf · Exploit
• https://t.me/cvenotify/107639 · Publicação no Telegram
• https://briarproject.org/news/2023-three-security-issues-found-and-fixed · Aviso do Fabricante
• https://t.me/cvenotify/51076 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33981 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33981 · Nota de Segurança
• https://t.me/cibsecurity/64713 · Publicação no Telegram