PT-2023-28997 · Nexkey · Nexkey

Nexryai · Publicado 2023-10-04 · Atualizado 2023-10-11 · CVE-2023-43805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nexkey versions prior to 12.121.9

Description The issue is related to incomplete URL validation, which can allow users to bypass authentication and access the job queue dashboard. This is a problem in a decentralized social media platform.

Recommendations For versions prior to 12.121.9, update to version 12.121.9 to resolve the issue. As a temporary workaround, consider blocking access to the vulnerable endpoint using tools such as Cloudflare's WAF.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-43805

GHSA-9FJ2-GJCF-CQQC

GHSA-G8W5-568F-FFWF

Produtos afetados

Nexkey

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43805.json · Exploit
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc · Nota
• https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf · Aviso do Fabricante
• https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-43805 · Nota de Segurança
• https://twitter.com/cracbot/status/1710075125268451366 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43805 · Aviso do Fabricante
• https://t.me/cibsecurity/71641 · Publicação no Telegram