PT-2023-29037 · Emsigner · Emsigner

Jean Paul Granados · Publicado 2023-11-13 · Atualizado 2023-11-17 · CVE-2023-43900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMSigner version 2.8.7

Description The issue allows attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters. This is due to Insecure Direct Object References (IDOR) in the application.

Recommendations For EMSigner version 2.8.7, consider restricting access to the documentID and EncryptedDocumentId parameters to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters in sensitive operations until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-43900

Produtos afetados

Emsigner

Referências · 5

• 🔥 https://secpro.llc/emsigner-cve-3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-43900 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1724289183575875744 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1724320364669386757 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-43900 · Nota de Segurança