PT-2023-31801 · Unknown · Sandbox Accounts For Events

Mahmoud0X00 · Publicado 2023-12-22 · Atualizado 2024-01-04 · CVE-2023-51386

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sandbox Accounts for Events versions prior to 1.10.0

Description The issue allows authenticated users to potentially read data from the events table by sending request payloads to the "events API", collecting information on planned events, timeframes, budgets, and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider restricting access to the "events API" to minimize the risk of exploitation. Avoid using the events API to collect sensitive information until the issue is resolved.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2023-51386

GHSA-P7W3-J66H-M7MX

Produtos afetados

Sandbox Accounts For Events

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51386.json · Exploit
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mx · Nota
• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-51386 · Nota de Segurança
• https://twitter.com/CVEnew/status/1738322047468458257 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-51386 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1738624164762726640 · Publicação no Twitter
• https://t.me/cvenotify/65008 · Publicação no Telegram