PT-2023-28730 · Submitty · Submitty

Richcfno1 · Publicado 2023-11-02 · Atualizado 2023-11-10 · CVE-2023-43194

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Submitty versions prior to 22.06.00

Description The issue allows an attacker to delete any post in the forum by modifying a request parameter, due to incorrect access control. This can be achieved by altering the request parameter, although the specific parameter name is not provided. The attack vector involves manipulating this parameter to gain unauthorized access to post deletion functionality.

Recommendations For versions prior to 22.06.00, update to version 22.06.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the forum post deletion functionality until a patch is applied. Avoid using modified request parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-43194

Produtos afetados

Submitty

Referências · 7

• 🔥 https://fuchai.net/cve/CVE-2023-43194 · Exploit
• https://github.com/Submitty/Submitty/pull/8032 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1720241526591107508 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43194 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1720193575391048126 · Publicação no Twitter
• https://t.me/cvenotify/60430 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-43194 · Nota de Segurança