PT-2023-23162 · Effectindex · Tripreporter

5Ht2 · Published 2023-05-08 · Updated 2023-05-15 · CVE-2023-31123

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions effectindex/tripreporter versions prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b

Description The issue concerns an improper password verification vulnerability. This vulnerability allows any user with a password matching the password requirements to log in as any user, potentially leading to access to accounts and data loss of the user.

Recommendations For versions prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, update to this commit or newer as soon as possible. As a temporary workaround, someone running their own instance may apply the patch manually.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-31123

GHSA-356R-RWP8-H6M6

Affected Products

Tripreporter

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31123.json · Exploit
• https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-h6m6 · Vendor Advisory
• https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e29874296c8729dd53b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-31123 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31123 · Vendor Advisory
• https://t.me/cvenotify/50004 · Telegram Post