PT-2023-6721 · Iagona · Iagona Scrutisweb

Jorian Van Den Hout + 2 · Publicado 2023-07-18 · Atualizado 2023-08-16 · CVE-2023-38257

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Iagona ScrutisWeb versions 2.1.37 and prior

Description The issue is related to an insecure direct object reference vulnerability. This could allow an unauthenticated user to view profile information, including user login names and encrypted passwords. The vulnerability is associated with an error in processing user-controlled authorization keys.

Recommendations For Iagona ScrutisWeb versions 2.1.37 and prior, update to a version later than 2.1.37 to resolve the issue. As a temporary workaround, consider restricting access to profile information to minimize the risk of exploitation. Avoid using the vulnerable profile information endpoint until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

BDU:2023-07494

CVE-2023-38257

Produtos afetados

Iagona Scrutisweb

Referências · 9

• https://t.me/cvenotify/55438 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38257 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38257 · Nota de Segurança
• https://twitter.com/raasangandhi/status/1691166932546764800 · Publicação no Twitter
• https://cisa.gov/news-events/ics-advisories/icsa-23-199-03 · Nota
• https://t.me/echeloneyes/1854 · Publicação no Telegram
• https://twitter.com/fletch_ai/status/1691602419573006381 · Publicação no Twitter
• https://t.me/cibsecurity/66936 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-07494 · Nota de Segurança