PT-2023-7628 · Asustor · Asustor Data Master

Stéphane Chauveau · Publicado 2023-08-22 · Atualizado 2023-08-28 · CVE-2023-3699

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 and below ASUSTOR Data Master (ADM) versions 4.1.0 and below ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below

Description The issue is related to improper privilege management in ASUSTOR Data Master (ADM), allowing an unprivileged local user to modify the configuration of storage devices.

Recommendations For ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 and below, update to a version above 4.0.6.RIS1 to resolve the issue. For ASUSTOR Data Master (ADM) versions 4.1.0 and below, update to a version above 4.1.0 to resolve the issue. For ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below, update to a version above 4.2.2.RI61 to resolve the issue.

Correção

Command Injection

Improper Privilege Management

Enumeração de Fraquezas

CWE-77

CWE-269

Identificadores relacionados

BDU:2023-08688

CVE-2023-3699

Produtos afetados

Asustor Data Master

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3699 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08688 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3699 · Aviso do Fabricante
• https://github.com/advisories/GHSA-phmm-962c-7vph · Nota
• https://t.me/cvenotify/57460 · Publicação no Telegram
• https://asustor.com/security/security_advisory_detail?id=29 · Aviso do Fabricante
• https://t.me/cibsecurity/69006 · Publicação no Telegram