PT-2023-28721 · Macrob7 · Macrob7 Macs Framework Content Management System

Ally Petitt · Publicado 2023-09-26 · Atualizado 2023-10-02 · CVE-2023-43154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Macrob7 Macs Framework Content Management System (CMS) version 1.1.4f

Description The issue is related to a PHP type confusion vulnerability due to loose comparison in the isValidLogin() function during a login attempt. This vulnerability can lead to authentication bypass and takeover of the administrator account.

Recommendations For Macrob7 Macs Framework Content Management System (CMS) version 1.1.4f, consider disabling the isValidLogin() function until a patch is available to prevent potential exploitation. Restrict access to the login functionality to minimize the risk of authentication bypass.

Correção

Type Confusion

Enumeração de Fraquezas

CWE-843

Identificadores relacionados

CVE-2023-43154

Produtos afetados

Macrob7 Macs Framework Content Management System

Referências · 5

• https://cxsecurity.com/issue/WLB-2023090075 · Nota
• https://twitter.com/CVEnew/status/1706770244440834380 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-43154 · Nota de Segurança
• https://github.com/ally-petitt/macs-cms-auth-bypass · Nota
• https://osv.dev/vulnerability/CVE-2023-43154 · Aviso do Fabricante