PT-2023-4580 · Iagona · Iagona Scrutisweb

Jorian Van Den Hout + 2 · Publicado 2023-07-18 · Atualizado 2023-08-16 · CVE-2023-33871

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Iagona ScrutisWeb versions 2.1.37 and prior

Description The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to gain direct access to any arbitrary file outside the webroot. Researchers found several flaws in the ScrutisWeb ATM fleet monitoring software that can expose ATMs to hacking.

Recommendations For Iagona ScrutisWeb versions 2.1.37 and prior, update to a version later than 2.1.37 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories outside the webroot to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-36

Identificadores relacionados

BDU:2023-04987

CVE-2023-33871

Produtos afetados

Iagona Scrutisweb

Referências · 8

• https://twitter.com/raasangandhi/status/1691166932546764800 · Publicação no Twitter
• https://cisa.gov/news-events/ics-advisories/icsa-23-199-03 · Nota
• https://osv.dev/vulnerability/CVE-2023-33871 · Aviso do Fabricante
• https://twitter.com/shah_sheikh/status/1691365622779990017 · Publicação no Twitter
• https://t.me/echeloneyes/1854 · Publicação no Telegram
• https://twitter.com/fletch_ai/status/1691602419573006381 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-33871 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04987 · Nota de Segurança