PT-2023-28210 · Ca · Arcserve Udp

CVE-2023-42000 · Publicado 2023-11-27 · Atualizado 2024-01-11

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arcserve UDP versions prior to 9.2

Description The issue allows an unauthenticated remote attacker to exploit a path traversal vulnerability in the com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload() function to upload arbitrary files to any location on the file system where the UDP agent is installed.

Recommendations For versions prior to 9.2, update to version 9.2 or later to resolve the issue. As a temporary workaround, consider disabling the doUpload() function in FileHandlingServlet until a patch is available. Restrict access to the FileHandlingServlet to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-42000

Produtos afetados

Arcserve Udp

Referências · 8

• 🔥 https://tenable.com/security/research/tra-2023-37 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-42000 · Nota de Segurança
• https://t.me/cvenotify/66976 · Publicação no Telegram
• https://twitter.com/ChannelSkell/status/1745555110573314418 · Publicação no Twitter
• https://twitter.com/AWNetworks/status/1732770040200434060 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-42000 · Aviso do Fabricante
• https://t.me/cvenotify/62119 · Publicação no Telegram
• https://t.me/cvenotify/61268 · Publicação no Telegram