PT-2023-8297 · Nginx+1 · Nginx+1

CVE-2023-50919

·

Publicado

2023-12-15

·

Atualizado

2024-01-26

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GL.iNet devices versions prior to 4.5.0
Description An issue was discovered in GL.iNet devices, where there is an NGINX authentication bypass via Lua string pattern matching. This allows a remote attacker to bypass authentication and gain unauthorized access to protected information.
Recommendations For versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to Lua scripts to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2024-00401
CVE-2023-50919

Produtos afetados

Gl.Inet
Nginx