PT-2023-20766 · Unknown · Rosariosis

Published 2023-05-12 · Updated 2023-05-19 · CVE-2023-2665

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RosarioSIS versions prior to 11.0

Description The issue allows unauthorized access to sensitive data due to a lack of access control in a mechanism. Specifically, it enables anyone to download and view file attachments under the salaries module, regardless of their authentication status. The file names follow a predictable format, including a date in YYYY-MM-DD format and a random six-digit string, making it relatively easy for attackers to enumerate file names using automated tools. This could potentially allow attackers to gain access to sensitive salary information.

Recommendations For versions prior to 11.0, update to version 11.0 or later, which includes a patch that adds microseconds to filenames, making them harder to guess and thereby mitigating the risk of unauthorized access to sensitive salary information.

Exploit

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-921

CWE-922

Related Identifiers

CVE-2023-2665

GHSA-36CM-H8GV-MG97

Affected Products

Rosariosis

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2665.json · Exploit
• https://github.com/francoisjacquet/rosariosis/commit/09d5afaa6be07688ca1a7ac3b755b5438109e986 · Patch
• https://osv.dev/vulnerability/GHSA-36cm-h8gv-mg97 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2665 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2665 · Vendor Advisory
• https://github.com/francoisjacquet/rosariosis · Note
• https://huntr.dev/bounties/42f38a84-8954-484d-b5ff-706ca0918194 · Note