PT-2023-5905 · Atos · Atos Unify Openscape 4000 Manager Platform+1
CVE-2023-45356
·
Publicado
2023-08-10
·
Atualizado
2023-10-12
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000
Atos Unify OpenScape 4000 Manager Platform V10 R1 before Hotfix V10 R1.42.2
Description
The issue is related to insufficient input data cleaning when processing dtb files, allowing an authenticated attacker to inject commands into the platform operating system. This can lead to administrative access via dtb pages of the platform portal.
Recommendations
For Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000, apply Hotfix V10 R1.42.2 to resolve the issue.
For Atos Unify OpenScape 4000 Manager Platform V10 R1 before Hotfix V10 R1.42.2, apply Hotfix V10 R1.42.2 to resolve the issue.
As a temporary workaround, consider restricting access to dtb pages of the platform portal to minimize the risk of exploitation.
Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Atos Unify Openscape 4000 Manager Platform
Atos Unify Openscape 4000 Platform