PT-2023-25589 · Ilias · Ilias

CVE-2023-36487 · Publicado 2023-06-29 · Atualizado 2024-11-26

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ILIAS versions 7.0 beta1 through 7.20 ILIAS versions 8.0 beta1 through 8.1

Description The password reset function allows remote attackers to take over the account.

Recommendations For ILIAS versions 7.0 beta1 through 7.20, consider disabling the password reset function until a patch is available. For ILIAS versions 8.0 beta1 through 8.1, consider disabling the password reset function until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2023-36487

Produtos afetados

Ilias

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36487.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-36487 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36487 · Nota de Segurança
• https://t.me/cvenotify/53327 · Publicação no Telegram
• https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141703&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI · Nota
• https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141694&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI · Nota
• https://t.me/cibsecurity/65734 · Publicação no Telegram