PT-2023-1875 · Unknown · Igss Data Server+2
Published
2023-03-14
·
Updated
2023-03-24
·
CVE-2023-27982
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
IGSS Data Server versions 16.0.0.23040 and prior
IGSS Dashboard versions 16.0.0.23040 and prior
Custom Reports versions 16.0.0.23040 and prior
Description
A vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory. When an attacker sends specific crafted messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malicious dashboard file. The issue is related to insufficient verification of data authenticity.
Recommendations
For IGSS Data Server versions 16.0.0.23040 and prior, update to a version later than 16.0.0.23040 to resolve the issue.
For IGSS Dashboard versions 16.0.0.23040 and prior, update to a version later than 16.0.0.23040 to resolve the issue.
For Custom Reports versions 16.0.0.23040 and prior, update to a version later than 16.0.0.23040 to resolve the issue.
As a temporary workaround, consider restricting access to the TCP port 12401 to minimize the risk of exploitation.
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Custom Reports
Igss Dashboard
Igss Data Server