PT-2023-32362 · Columbiasoft · Columbiasoft Document Locator

Matt Biedronski + 2 · Publicado 2023-10-27 · Atualizado 2025-03-14 · CVE-2023-5830

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColumbiaSoft Document Locator versions prior to 7.2 SP4 and 2021.1

Description A critical vulnerability has been found in ColumbiaSoft Document Locator, affecting an unknown part of the file "/api/authentication/login" of the component WebTools. The manipulation of the Server argument leads to improper authentication. It is possible to initiate the attack remotely.

Recommendations For versions prior to 7.2 SP4, upgrade to version 7.2 SP4 to address this issue. For versions prior to 2021.1, upgrade to version 2021.1 to address this issue. As a temporary workaround, consider restricting access to the "/api/authentication/login" endpoint until a patch is available. Avoid using the Server argument in the affected API endpoint until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-5830

Produtos afetados

Columbiasoft Document Locator

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-5830 · Nota de Segurança
• https://twitter.com/Gonski47/status/1763270252354326815 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1718004200506880450 · Publicação no Twitter
• https://vuldb.com/?id.243729 · Nota
• https://twitter.com/Gonski47/status/1771968541039681637 · Publicação no Twitter
• https://t.me/thehackernews/6480 · Publicação no Telegram
• https://t.me/true_secator/6843 · Publicação no Telegram
• https://vuldb.com/?ctiid.243729 · Nota
• https://twitter.com/Gonski47/status/1770074136829694077 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1718033506880635276 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5830 · Aviso do Fabricante