PT-2023-22446 · Senayan · Slims

Rahad Chowdhury · Published 2023-04-14 · Updated 2023-04-25 · CVE-2023-29850

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SENAYAN Library Management System (SLiMS) Bulian version 9.5.2

Description The issue allows attackers to obtain information such as the user's geolocation and device information because the system does not strip exif data from uploaded images.

Recommendations For version 9.5.2, consider removing or stripping exif data from uploaded images to prevent information disclosure. As a temporary workaround, restrict image uploads until a proper fix is implemented.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-29850

Affected Products

Slims

References · 5

• 🔥 https://github.com/slims/slims9_bulian/issues/186 · Exploit
• https://osv.dev/vulnerability/CVE-2023-29850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29850 · Security Note
• https://t.me/cvenotify/49037 · Telegram Post
• https://t.me/cibsecurity/62149 · Telegram Post