PT-2023-25053 · Topdesk · Topdesk

Char49 · Publicado 2023-06-22 · Atualizado 2023-06-30 · CVE-2023-34923

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TOPdesk version 12.10.12

Description The issue allows bad actors with credentials to authenticate with the Identity Provider to impersonate any TOPdesk user via SAML Response manipulation. This is due to XML Signature Wrapping (XSW) in the SAML-based Single Sign-on feature.

Recommendations For TOPdesk version 12.10.12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-34923

Produtos afetados

Topdesk

Referências · 6

• 🔥 https://char49.com/articles/topdesk-vulnerable-to-xml-signature-wrapping-attacks · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34923 · Nota de Segurança
• https://my.topdesk.com/tas/public/ssp/content/detail/knowledgeitem?unid=56a16ba1c2824e9a82655892ba75d3c0 · Nota
• https://t.me/cibsecurity/65432 · Publicação no Telegram
• https://t.me/cvenotify/52890 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34923 · Aviso do Fabricante