PT-2023-29969 · Unknown · Sunnytoo Sturls

CVE-2023-46348 · Publicado 2023-12-14 · Atualizado 2023-12-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SunnyToo sturls versions prior to 1.1.13

Description The issue allows attackers to escalate privileges and obtain sensitive information. This is achieved via the StUrls::hookActionDispatcher and StUrls::getInstanceId methods.

Recommendations For versions prior to 1.1.13, update to version 1.1.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the StUrls::hookActionDispatcher and StUrls::getInstanceId methods until a patch is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-46348

Produtos afetados

Sunnytoo Sturls

Referências · 6

• https://security.friendsofpresta.org/modules/2023/12/07/sturls.html · Correção
• https://twitter.com/CVEnew/status/1735227039441879305 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-46348 · Nota de Segurança
• https://t.me/cvenotify/64012 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46348 · Aviso do Fabricante
• https://t.me/cvenotify/63666 · Publicação no Telegram