PT-2023-1688 · Unknown · Igss Data Server+2

Published

2023-03-14

·

Updated

2023-03-24

·

CVE-2023-27980

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions IGSS Data Server versions 16.0.0.23040 and prior IGSS Dashboard versions 16.0.0.23040 and prior Custom Reports versions 16.0.0.23040 and prior
Description A Missing Authentication for Critical Function issue exists in the Data Server TCP interface, allowing the creation of a malicious report file in the IGSS project report directory. This could lead to remote code execution when a victim opens the report. The vulnerability can be exploited by a remote attacker to execute arbitrary code.
Recommendations For IGSS Data Server versions 16.0.0.23040 and prior, consider disabling the Data Server TCP interface until a patch is available. For IGSS Dashboard versions 16.0.0.23040 and prior, restrict access to the report directory to minimize the risk of exploitation. For Custom Reports versions 16.0.0.23040 and prior, avoid using the vulnerable function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-01259
CVE-2023-27980
ZDI-23-339

Affected Products

Custom Reports
Igss Dashboard
Igss Data Server