PT-2023-19295 · Softwarex · Softwarex

F0Ns1 · Published 2023-03-10 · Updated 2023-03-16 · CVE-2023-23911

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to v6

Description An improper access control issue exists that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.

Recommendations For versions prior to v6, update to version v6 or later to resolve the issue. As a temporary workaround, consider restricting user permissions to change the group key of a chat room until a patch is available.

Fix

Inadequate Encryption Strength

Improper Access Control

Weakness Enumeration

CWE-326

CWE-284

Related Identifiers

CVE-2023-23911

Affected Products

Softwarex

References · 5

• https://osv.dev/vulnerability/CVE-2023-23911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23911 · Security Note
• https://t.me/cibsecurity/59855 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23911 · Note
• https://hackerone.com/reports/1757663 · Note