PT-2023-26557 · Unknown · Cloudexplorer Lite

Hbdxmz · Publicado 2023-08-04 · Atualizado 2023-08-09 · CVE-2023-38692

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudExplorer Lite versions prior to 1.3.1

Description The issue concerns a command injection vulnerability in the installation function within the module management of CloudExplorer Lite, an open-source cloud management platform. This vulnerability has been fixed in version 1.3.1. There are no known workarounds aside from upgrading to the fixed version.

Recommendations For versions prior to 1.3.1, upgrade to version 1.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the module management installation function until the upgrade can be applied.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-38692

GHSA-7WRC-F42M-9V5W

Produtos afetados

Cloudexplorer Lite

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38692.json · Exploit
• 🔥 https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-7wrc-f42m-9v5w · Exploit
• https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.3.1 · Nota
• https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/blob/v1.3.0/framework/management-center/backend/src/main/java/com/fit2cloud/controller/ModuleManageController.java · Nota
• https://t.me/cibsecurity/67792 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38692 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38692 · Nota de Segurança