PT-2023-32620 · Tyler Technologies · Court Case Management Plus

Jason Parker · Publicado 2023-11-30 · Atualizado 2023-12-06 · CVE-2023-6344

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Court Case Management Plus (affected versions not specified) Tyler Technologies Court Case Management Plus (affected versions not specified)

Description The issue concerns insufficient permission checks in public court record platforms from multiple vendors, allowing unauthorized public access to sealed, confidential, and unreleased information. A specific instance involves Tyler Technologies Court Case Management Plus, where a remote, unauthenticated attacker can enumerate directories using the tiffserver/te003.aspx or te004.aspx API endpoints, specifically the ifolder parameter.

Recommendations For Court Case Management Plus, restrict access to the tiffserver/te003.aspx and te004.aspx API endpoints to prevent directory enumeration. For Tyler Technologies Court Case Management Plus, avoid using the ifolder parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-6344

Produtos afetados

Court Case Management Plus

Referências · 10

• https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md · Nota
• https://twitter.com/VulmonFeeds/status/1730276299288027239 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1730296119165645229 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6344 · Nota de Segurança
• https://aquaforest.com/blog/aquaforest-tiff-server-sunsetting · Aviso do Fabricante
• https://cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems · Nota
• https://aquaforest.com/blog/tiff-server-security-update · Aviso do Fabricante
• https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents · Nota
• https://tylertech.com/solutions/courts-public-safety/courts-justice · Nota
• https://t.me/cvenotify/62562 · Publicação no Telegram