PT-2023-32769 · Unknown · Amazing Little Poll

David Utón Amaya + 1 · Publicado 2023-12-13 · Atualizado 2023-12-22 · CVE-2023-6768

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazing Little Poll versions 1.3 through 1.4

Description The issue allows an unauthenticated user to access the admin panel without providing any credentials by accessing the "lp admin.php?adminstep=" parameter. This could enable unauthorized access to sensitive areas of the application.

Recommendations For versions 1.3 and 1.4, consider restricting access to the "lp admin.php?adminstep=" parameter until a patch is available. As a temporary workaround, avoid using the adminstep parameter in the "lp admin.php" endpoint to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-6768

Produtos afetados

Amazing Little Poll

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-6768 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1737436025188745339 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6768 · Nota de Segurança
• https://t.me/cvenotify/64365 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1737416054102766027 · Publicação no Twitter
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll · Nota
• https://twitter.com/David_Uton/status/1734985279310569888 · Publicação no Twitter