PT-2023-27900 · Softwarex · Softwarex

Mingyu Chen · Publicado 2023-12-18 · Atualizado 2023-12-22 · CVE-2023-41314

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 2.0.3

Description The issue allows unauthenticated access through the API endpoints "/api/snapshot" and "/api/get log file". This could potentially lead to a DoS attack or allow an attacker to retrieve arbitrary files from the FE node.

Recommendations For versions prior to 2.0.3, upgrade to version 2.0.3 to fix the issue. As a temporary workaround, consider restricting access to the "/api/snapshot" and "/api/get log file" API endpoints to minimize the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-41314

Produtos afetados

Softwarex

Referências · 4

• https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-41314 · Aviso do Fabricante
• https://t.me/cvenotify/64927 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-41314 · Nota de Segurança