PT-2023-26664 · Unknown · Opensis Classic

Florian Walter · Publicado 2023-11-20 · Atualizado 2023-11-30 · CVE-2023-38884

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openSIS Classic version 9.0

Description The issue allows an unauthenticated remote attacker to access any student's files. This is achieved by visiting the "/assets/studentfiles/-" API endpoint, where studentId and filename are variables that can be manipulated to access different files.

Recommendations For openSIS Classic version 9.0, restrict access to the "/assets/studentfiles/-" API endpoint to prevent unauthorized file access. Consider implementing proper authentication and authorization mechanisms to ensure that only authorized users can access student files.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-38884

Produtos afetados

Opensis Classic

Referências · 5

• 🔥 https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38884 · Exploit
• https://github.com/OS4ED/openSIS-Classic · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38884 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-38884 · Aviso do Fabricante
• https://os4ed.com · Nota