PT-2023-21240 · Taphome · Taphome

Noam Moshe · Published 2023-07-17 · Updated 2023-08-09 · CVE-2023-2760

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions TapHome versions prior to 2023.2

Description An SQL injection issue exists in the HandleMessageUpdateDevicePropertiesRequest function, allowing low-privileged users to inject arbitrary SQL directives into an SQL query. This enables the execution of arbitrary SQL commands, providing full reading access, and may also lead to limited write access and temporary Denial-of-Service.

Recommendations For versions prior to 2023.2, update to version 2023.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the HandleMessageUpdateDevicePropertiesRequest function until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-2760

Affected Products

Taphome

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-2760 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2760 · Vendor Advisory
• https://claroty.com/team82/disclosure-dashboard/cve-2023-2759 · Note
• https://t.me/cvenotify/54470 · Telegram Post
• https://t.me/cvenotify/56072 · Telegram Post
• https://t.me/cibsecurity/66803 · Telegram Post