PT-2023-20953 · Unknown · Opengoofy Hippo4J

Laoquanshi · Published 2023-03-27 · Updated 2023-03-31 · CVE-2023-27096

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenGoofy Hippo4j version 1.4.3

Description The issue allows an attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module.

Recommendations For OpenGoofy Hippo4j version 1.4.3, consider restricting access to the ConfigVerifyController function until a patch is available.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-27096

GHSA-H855-6HPH-V363

Affected Products

Opengoofy Hippo4J

References · 6

• 🔥 https://github.com/opengoofy/hippo4j/issues/1060 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27096 · Security Note
• https://osv.dev/vulnerability/GHSA-h855-6hph-v363 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27096 · Vendor Advisory
• https://github.com/opengoofy/hippo4j · Note
• https://t.me/cibsecurity/60782 · Telegram Post