PT-2023-28319 · Unknown · Fl3Xx Dispatch+1

Publicado 2023-09-20 · Atualizado 2023-09-22 · CVE-2023-42334

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fl3xx Dispatch version 2.10.37 fl3xx Crew version 2.10.37

Description An Indirect Object Reference (IDOR) issue allows a remote attacker to escalate privileges via the user parameter. This enables the attacker to potentially gain unauthorized access to sensitive information or perform actions that would normally be restricted.

Recommendations For Fl3xx Dispatch version 2.10.37, consider disabling the functionality that utilizes the user parameter until a patch is available. For fl3xx Crew version 2.10.37, restrict access to the component that uses the user parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-42334

Produtos afetados

Fl3Xx Dispatch

Fl3Xx Crew

Referências · 8

• 🔥 https://0xhunter20.medium.com/an-idor-lead-to-viewing-other-users-files-cve-2023-42334-702de328c453 · Exploit
• https://t.me/cibsecurity/70844 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-42334 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42334 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1704630424369340660 · Publicação no Twitter
• https://t.me/cvenotify/58364 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1704580692674257286 · Publicação no Twitter
• https://t.me/cvenotify/58220 · Publicação no Telegram