PT-2023-25634 · Basecamp · Com.Basecamp.Bc3

Fr4Via · Publicado 2023-06-25 · Atualizado 2023-06-30 · CVE-2023-36612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.basecamp.bc3 versions prior to 4.2.1

Description Directory traversal can occur in the com.basecamp.bc3 application, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses, containing sensitive information, to third-party applications by using a custom-crafted deeplink scheme.

Recommendations For versions prior to 4.2.1, update to version 4.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom-crafted deeplink schemes to minimize the risk of exploitation. Avoid using malicious intents that could redirect server responses to third-party applications until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-36612

Produtos afetados

Com.Basecamp.Bc3

Referências · 6

• 🔥 https://hackerone.com/reports/1710541 · Exploit
• https://osv.dev/vulnerability/CVE-2023-36612 · Aviso do Fabricante
• https://t.me/cibsecurity/65492 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-36612 · Nota de Segurança
• https://t.me/cvenotify/53024 · Publicação no Telegram
• https://t.me/cvenotify/53464 · Publicação no Telegram