PT-2023-22594 · 4D Server · 4D Server

Karlo Dautović · CVE-2023-30223 · Published 2023-06-16 · Updated 2023-12-14

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions 4D Server software versions v17 through v19 R7

Description A broken authentication issue allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.

Recommendations For versions v17 through v19 R7, update to a version later than v19 R7 to resolve the issue. At the moment, there is no information about other mitigation measures for this specific issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-30223

Affected Products

4D Server

References · 6

• 🔥 https://infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-30223 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30223 · Vendor Advisory
• https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure · Note
• https://t.me/cvenotify/63610 · Telegram Post
• https://packetstormsecurity.com · Note