PT-2023-4675 · Unknown · Mxsecurity

James Sebree · Publicado 2023-08-08 · Atualizado 2023-09-19 · CVE-2023-39983

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MXsecurity versions prior to v1.0.1

Description A vulnerability has been identified that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI. This issue might allow an unauthenticated remote attacker to register or add devices via the nsm-web application. The vulnerability is related to insufficient control of modification of dynamically defined object characteristics.

Recommendations For MXsecurity versions prior to v1.0.1, update to version v1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the nsm-web application to minimize the risk of exploitation. Avoid using the nsm-web UI to register or add devices until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-913

CWE-915

Identificadores relacionados

BDU:2023-05088

CVE-2023-39983

Produtos afetados

Mxsecurity

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-39983 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1697954562530062360 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-05088 · Nota de Segurança
• https://vuldb.com/?id.238620 · Nota
• https://moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1697985238553464901 · Publicação no Twitter
• https://twitter.com/NUYTSTECH/status/1704085941743419720 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39983 · Nota de Segurança