PT-2023-25623 · Pos/ Dienstleistung · Cashit!

Daniel + 12 · Publicado 2023-10-03 · Atualizado 2024-02-10 · CVE-2023-3656

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cashIT! - serving solutions versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37

Description The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint exposed to the network.

Recommendations For versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37, as a temporary workaround, consider restricting access to the exposed HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-749

CWE-94

Identificadores relacionados

CVE-2023-3656

Produtos afetados

Cashit!

Referências · 10

• https://osv.dev/vulnerability/CVE-2023-3656 · Aviso do Fabricante
• https://twitter.com/jfrog/status/1756367425212162480 · Publicação no Twitter
• https://t.me/cvenotify/65414 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1709114284481847309 · Publicação no Twitter
• https://t.me/cvenotify/60359 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1709156947738398776 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-3656 · Nota de Segurança
• https://t.me/cibsecurity/71465 · Publicação no Telegram
• https://doi.org/10.35011/ww2q-d522 · Nota
• https://cashit.at · Nota