PT-2023-17134 · Ellucian · Ellucian Banner Web Tailor

Published 2023-03-25 · Updated 2023-10-09 · CVE-2023-1632

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Ellucian Banner Web Tailor version 8.6

Description A critical vulnerability has been found in the Login Page component of Ellucian Banner Web Tailor. The issue affects unknown code of the file /PROD ar/twbkwbis.P FirstMenu. The manipulation of the PIDM/WEBID argument leads to improper authorization. This can be initiated remotely, and after submitting proper login credentials, it becomes possible to generate new valid session identifiers on the OTP page.

Recommendations For Ellucian Banner Web Tailor version 8.6, consider restricting access to the Login Page component until a patch is available. As a temporary workaround, avoid using the PIDM/WEBID argument in the affected login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-1632

Affected Products

Ellucian Banner Web Tailor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-1632 · Security Note
• https://t.me/cvenotify/46862 · Telegram Post
• https://t.me/cibsecurity/60746 · Telegram Post
• https://t.me/cvenotify/46867 · Telegram Post