PT-2023-29650 · Cfengine · Cfengine Enterprise

Chad Deguira + 1 · Publicado 2023-11-14 · Atualizado 2026-01-08 · CVE-2023-45684

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CFEngine Enterprise versions 3.6.0 through 3.18.5 CFEngine Enterprise versions 3.21.0 through 3.21.2

Description The issue is a SQL Injection vulnerability in the Mission Portal login page of the CFEngine hub. This vulnerability allows for SQL Injection attacks.

Recommendations For CFEngine Enterprise versions 3.6.0 through 3.18.5, update to version 3.18.6. For CFEngine Enterprise versions 3.21.0 through 3.21.2, update to version 3.21.3. As a temporary workaround, consider restricting access to the Mission Portal login page until a patch is applied.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-45684

Produtos afetados

Cfengine Enterprise

Referências · 10

• https://osv.dev/vulnerability/CVE-2023-45684 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45684 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-45684 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45684 · Nota de Segurança
• https://twitter.com/CVEnew/status/1724440146446045304 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1724485754359812108 · Publicação no Twitter
• https://twitter.com/dailycve/status/2009399067982315608 · Publicação no Twitter
• https://t.me/cvenotify/60769 · Publicação no Telegram
• https://cfengine.com/blog/2023/cve-2023-45684 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-45684 · Nota de Segurança