PT-2023-25364 · No Magic · Teamwork Cloud

Johannes Rückert · Publicado 2023-10-09 · Atualizado 2023-10-20 · CVE-2023-3589

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teamwork Cloud versions No Magic Release 2021x through No Magic Release 2022x

Description A Cross-Site Request Forgery (CSRF) vulnerability could allow an attacker to send a specifically crafted query to the server under certain conditions.

Recommendations For versions No Magic Release 2021x through No Magic Release 2022x, consider implementing additional security measures to prevent CSRF attacks, such as validating request headers and using anti-CSRF tokens. As a temporary workaround, restrict access to sensitive server queries until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-3589

Produtos afetados

Teamwork Cloud

Referências · 6

• https://3ds.com/vulnerability/advisories · Aviso do Fabricante
• https://t.me/cvenotify/59411 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3589 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3589 · Aviso do Fabricante
• https://t.me/cibsecurity/71810 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1711309753177997330 · Publicação no Twitter