PT-2023-14300 · Gx · Xperiencentral

Published 2023-07-26 · Updated 2023-08-04 · CVE-2022-43712

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GX Software XperienCentral versions 10.36.0 and earlier

Description The issue allows unauthorized users to post data to the server by sending POST requests to the /web/mvc endpoint if they can bypass other security filters.

Recommendations For GX Software XperienCentral versions 10.36.0 and earlier, consider blocking unauthorized POST requests to the /web/mvc endpoint to prevent unauthorized data from being posted to the server. As a temporary workaround, restrict access to this endpoint for unauthenticated users until a fix is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-43712

Affected Products

Xperiencentral

References · 4

• https://service.gxsoftware.com/hc/en-us/articles/4717373636381-Vulnerability-in-Spring-core-Spring4Shell- · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43712 · Security Note
• https://service.gxsoftware.com/hc/nl/articles/12208173122461 · Vendor Advisory