PT-2023-17438 · Datagear · Datagear

Yangyanglo · Published 2023-04-14 · Updated 2024-09-16 · CVE-2023-2042

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataGear versions up to 4.7.0/5.1.0

Description A problematic issue has been found in the JDBC Server Handler component of DataGear, allowing for deserialization through manipulation. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond.

Recommendations For versions up to 4.7.0/5.1.0, consider disabling the JDBC Server Handler component until a patch is available. Restrict access to the component to minimize the risk of exploitation. Avoid using the affected functionality of the JDBC Server Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-2042

Affected Products

Datagear

References · 10

• 🔥 https://github.com/yangyanglo/ForCVE/blob/main/2023-0x06.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-2042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2042 · Security Note
• https://vuldb.com/?submit.109292 · Note
• https://t.me/cvenotify/94747 · Telegram Post
• https://vuldb.com/?id.225920 · Note
• https://t.me/cibsecurity/62118 · Telegram Post
• https://t.me/cvenotify/48214 · Telegram Post
• https://vuldb.com/?ctiid.225920 · Note
• https://t.me/cvenotify/48220 · Telegram Post