PT-2023-22593 · 4D · 4D Server Application

Karlo Dautović · Published 2023-06-16 · Updated 2023-12-14 · CVE-2023-30222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 4D Server Application versions v17 through v19 R7

Description An information disclosure issue allows attackers to retrieve password hashes for all users via eavesdropping.

Recommendations For versions v17 through v19 R7, update to a version later than v19 R7 to resolve the issue.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2023-30222

Affected Products

4D Server Application

References · 6

• 🔥 https://infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server · Exploit
• https://osv.dev/vulnerability/CVE-2023-30222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30222 · Security Note
• https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure · Note
• https://t.me/cvenotify/63609 · Telegram Post
• https://packetstormsecurity.com · Note