PT-2023-23279 · Unknown · Sesami Cash Point & Transport Optimizer

Marcus Nilsson · Published 2023-12-28 · Updated 2024-01-08 · CVE-2023-31293

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6

Description An issue was discovered that allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option being disabled.

Recommendations For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the Reader system user's web browser access to the journal as a temporary workaround until a patch is available. Restrict access to the journal to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2023-31293

Affected Products

Sesami Cash Point & Transport Optimizer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-31293 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31293 · Vendor Advisory
• https://t.me/cvenotify/66583 · Telegram Post
• https://herolab.usd.de/en/security-advisories/usd-2022-0061 · Note
• https://t.me/cibsecurity/73876 · Telegram Post
• https://twitter.com/CVEnew/status/1740561145348456885 · Twitter Post