PT-2023-18284 · Code Dx · Code Dx

Published 2023-04-27 · Updated 2025-01-31 · CVE-2023-2158

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Code Dx versions prior to 2023.4.2

Description The issue allows a malicious actor to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher when generating the token. A malicious actor who creates this token can supply it to a separate Code Dx system, provided they know the username they want to impersonate, and impersonate the user.

Recommendations For Code Dx versions prior to 2023.4.2, update to version 2023.4.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of the "Remember Me" token until a patch is available. Restrict access to the system to minimize the risk of exploitation. Avoid using the username in the affected system until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2023-2158

Affected Products

Code Dx

References · 5

• https://community.synopsys.com/s/question/0D5Hr00006VdZblKAF/announcement-changelog-code-dx-202342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2158 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2158 · Vendor Advisory
• https://t.me/cvenotify/109523 · Telegram Post
• https://t.me/cibsecurity/63005 · Telegram Post