PT-2023-23076 · Clips2+2 · Clips2+2

Published 2023-06-26 · Updated 2023-07-05 · CVE-2023-30945

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multiple Services versions (affected versions not specified)

Description The issue is related to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. This allows a malicious attacker to read sensitive files from the filesystem or write/delete arbitrary files on the filesystem. The affected services include VHS (Video History Server), VCD (Video Clip Distributor), and Clips2.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Path traversal

Weakness Enumeration

CWE-287

CWE-22

Related Identifiers

CVE-2023-30945

Affected Products

Clips2

Vcd

Vhs

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-30945 · Security Note
• https://palantir.safebase.us/?tcuUid=e62e4dad-b39b-48ba-ba30-7b7c83406ad9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30945 · Vendor Advisory
• https://t.me/cibsecurity/65551 · Telegram Post