PT-2023-31619 · Unknown · Speckle Server

Fabis94 + 1 · Publicado 2023-12-14 · Atualizado 2023-12-28 · CVE-2023-50713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Speckle Server versions prior to 2.17.6

Description A vulnerability affects users who authorized an application with 'token write' scope or created a Personal Access Token (PAT) with token write scope. The issue allows a malicious actor to generate further tokens with additional privileges, up to the existing privileges of the user, using a token with only token write scope. This cannot be used to escalate a user's privileges or grant privileges on behalf of other users.

Recommendations For versions prior to 2.17.6, upgrade the server to version 2.17.6 or higher. Review existing tokens and permanently revoke any unrecognized tokens. Revoke existing tokens and create new tokens. Review usage of the account for suspicious activity.

Exploit

Correção

Enumeração de Fraquezas

CWE-1220

Identificadores relacionados

CVE-2023-50713

GHSA-XPF3-5Q5X-3QWH

Produtos afetados

Speckle Server

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50713.json · Exploit
• https://github.com/specklesystems/speckle-server/security/advisories/GHSA-xpf3-5q5x-3qwh · Nota
• https://github.com/specklesystems/speckle-server/releases/tag/2.17.6 · Nota
• https://github.com/specklesystems/speckle-server/commit/3689e1cd58ec4f06abee836af34889d6ce474571 · Correção
• https://twitter.com/CVEnew/status/1735369060756668516 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-50713 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50713 · Nota de Segurança