PT-2023-27817 · Unknown · Appsanywhere

Gaelan Steele · Publicado 2023-11-09 · Atualizado 2024-10-28 · CVE-2023-41137

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AppsAnywhere (affected versions not specified)

Description The issue concerns the symmetric encryption used to protect messages between the AppsAnywhere server and client. This encryption can be broken by reverse engineering the client, allowing an attacker to impersonate the AppsAnywhere server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-321

Identificadores relacionados

CVE-2023-41137

Produtos afetados

Appsanywhere

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-41137 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1722674464645693497 · Publicação no Twitter
• https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory · Aviso do Fabricante
• https://t.me/cvenotify/60651 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-41137 · Aviso do Fabricante