PT-2023-29052 · Dromara · Dromara Satoken

M4Ra7H0N · Publicado 2023-10-13 · Atualizado 2024-09-11 · CVE-2023-43961

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dromara SaToken versions 1.3.50RC and earlier

Description An issue in Dromara SaToken when using Spring dynamic controllers may cause an authentication bypass due to a specially crafted request.

Recommendations For Dromara SaToken versions 1.3.50RC and earlier, update to a version later than 1.3.50RC to resolve the issue. As a temporary workaround, consider restricting access to Spring dynamic controllers until a patch is available.

Exploit

Correção

Improper Authentication

Incorrect Authorization

Enumeração de Fraquezas

CWE-287

CWE-863

Identificadores relacionados

CVE-2023-43961

GHSA-W9VH-HV5G-7WMR

Produtos afetados

Dromara Satoken

Referências · 9

• 🔥 https://github.com/dromara/Sa-Token/issues/511 · Exploit
• https://github.com/dromara/Sa-Token · Nota
• https://twitter.com/VulmonFeeds/status/1713038577888575947 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-43961 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1713038324787449975 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1717056727424934296 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43961 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w9vh-hv5g-7wmr · Aviso do Fabricante
• https://t.me/cvenotify/94259 · Publicação no Telegram