PT-2023-32496 · Esm · Esm

Andre Waldhoff + 1 · Publicado 2023-11-29 · Atualizado 2023-12-05 · CVE-2023-6070

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ESM versions prior to 11.6.8

Description A server-side request forgery issue allows a low-privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data.

Recommendations For versions prior to 11.6.8, update to version 11.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the certificate validation functionality to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-6070

Produtos afetados

Esm

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-6070 · Aviso do Fabricante
• https://t.me/cvenotify/62311 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-6070 · Nota de Segurança
• https://kcm.trellix.com/corporate/index?page=content&id=SB10413 · Aviso do Fabricante
• https://t.me/cvenotify/61430 · Publicação no Telegram