PT-2023-22421 · Abstrium · Abstrium Pydio Cells

Ignatiusmichael · Published 2023-05-30 · Updated 2024-08-21 · CVE-2023-2980

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Abstrium Pydio Cells version 4.2.0

Description A critical vulnerability was found in the User Creation Handler component, leading to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue.

Recommendations For Abstrium Pydio Cells version 4.2.0, upgrade to version 4.2.1 to address the issue. As a temporary workaround, consider restricting access to the User Creation Handler component until the upgrade is applied.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-99

Related Identifiers

CVE-2023-2980

GHSA-J327-C69H-4GH8

GO-2023-2344

Affected Products

Abstrium Pydio Cells

References · 12

• 🔥 https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be · Exploit
• https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 · Patch
• https://osv.dev/vulnerability/GO-2023-2344 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2980 · Security Note
• https://osv.dev/vulnerability/GHSA-j327-c69h-4gh8 · Vendor Advisory
• https://github.com/pydio/cells · Note
• https://t.me/cvenotify/51369 · Telegram Post
• https://github.com/advisories/GHSA-j327-c69h-4gh8 · Note
• https://vuldb.com/?id.230212 · Note
• https://vuldb.com/?ctiid.230212 · Note
• https://t.me/cvenotify/51776 · Telegram Post