PT-2023-29633 · Unknown · Engelsystem

Sev-Hack · Publicado 2023-10-16 · Atualizado 2023-10-30 · CVE-2023-45659

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Engelsystem (affected versions not specified)

Description Engelsystem is a shift planning system for chaos events. If a user's password is compromised and an attacker gains access to the user's account, the attacker's session is not terminated if the user's account password is reset.

Recommendations Update installations to a version that includes the fix committed in dbb089315ff3d. As a temporary workaround, consider implementing additional security measures to monitor and terminate suspicious sessions. Restrict access to sensitive areas of the system until the update is applied. There are no known workarounds for this issue, so updating is the recommended course of action.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2023-45659

GHSA-F6MM-3V2H-JM6X

Produtos afetados

Engelsystem

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45659.json · Exploit
• 🔥 https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x · Exploit
• https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d · Correção
• https://twitter.com/IT_securitynews/status/1715300166540955747 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-45659 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-45659 · Aviso do Fabricante
• https://t.me/cibsecurity/72409 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1714153633846095922 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1714066896243347811 · Publicação no Twitter
• https://t.me/cvenotify/59557 · Publicação no Telegram