Daniel Pekarek

**Name of the Vulnerable Software and Affected Versions** cashIT! - serving solutions versions 03.A06rks 2023.02.37 and earlier **Description** The issue is related to an origin bypass via the host header in an HTTP request. This can be triggered by an HTTP endpoint exposed to the network. **Recommendations** For versions 03.A06rks 2023.02.37 and earlier, consider restricting access to HTTP endpoints exposed to the network as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** cashIT! - serving solutions versions to 03.A06rks 2023.02.37 **Description** The issue affects devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" and allows for the leakage of the database, including system settings and user accounts. This can be triggered by an HTTP endpoint exposed to the network. **Recommendations** For versions to 03.A06rks 2023.02.37, as a temporary workaround, consider restricting access to the exposed HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cashIT! - serving solutions versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 **Description** The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint exposed to the network. **Recommendations** For versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37, as a temporary workaround, consider restricting access to the exposed HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.