PT-2023-29480 · Yamcs · Yamcs

Andy Olchawa + 1 · Publicado 2023-10-19 · Atualizado 2023-10-25 · CVE-2023-45277

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yamcs version 5.8.6

Description The issue is related to directory traversal in the storage functionality of the API, allowing an attacker to escape the base directory of the buckets, navigate system directories, and read arbitrary files.

Recommendations For Yamcs version 5.8.6, as a temporary workaround, consider restricting access to the storage functionality of the API until a patch is available. Avoid using the API to navigate system directories or read arbitrary files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-45277

GHSA-W4M2-QMH3-2G8F

Produtos afetados

Yamcs

Referências · 10

• 🔥 https://linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies · Exploit
• https://github.com/yamcs/yamcs · Nota
• https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7 · Correção
• https://t.me/cibsecurity/72587 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45277 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45277 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1715071776474923195 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1715045333791801597 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-w4m2-qmh3-2g8f · Aviso do Fabricante
• https://t.me/cvenotify/59958 · Publicação no Telegram