PT-2023-26380 · Minitool · Minitool Power Data Recovery

0Dr3F · Publicado 2023-09-10 · Atualizado 2023-10-13 · CVE-2023-38353

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MiniTool Power Data Recovery versions 11.6 and before MiniTool Power Data Recovery version 11.5

Description The issue concerns an insecure in-app payment system in MiniTool Power Data Recovery, which can be exploited through a man-in-the-middle attack, allowing attackers to steal highly sensitive information.

Recommendations For MiniTool Power Data Recovery versions 11.6 and before, update to a version later than 11.6 to resolve the issue. For MiniTool Power Data Recovery version 11.5, update to a version later than 11.5 to resolve the issue. As a temporary workaround, consider disabling the in-app payment system until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2023-38353

Produtos afetados

Minitool Power Data Recovery

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-38353 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1704202655193550885 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1704161786478383498 · Publicação no Twitter
• https://t.me/cvenotify/58449 · Publicação no Telegram
• https://twitter.com/0Dr3f/status/1700952645253410913 · Publicação no Twitter
• https://0dr3f.github.io/cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38353 · Nota de Segurança
• https://t.me/cibsecurity/70738 · Publicação no Telegram