PT-2023-23289 · Unknown · Sesami Cash Point & Transport Optimizer

Marcus Nilsson · Published 2023-12-28 · Updated 2024-01-08 · CVE-2023-31302

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6

Description A Cross Site Scripting (XSS) issue allows remote attackers to execute arbitrary code via the Teller field. This enables attackers to inject malicious scripts into the website, potentially leading to unauthorized actions.

Recommendations For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the Teller field functionality until a patch is available to prevent exploitation. Additionally, restrict access to sensitive areas of the application to minimize the risk of arbitrary code execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-31302

Affected Products

Sesami Cash Point & Transport Optimizer

References · 5

• https://osv.dev/vulnerability/CVE-2023-31302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31302 · Security Note
• https://twitter.com/CVEnew/status/1740605898349806043 · Twitter Post
• https://t.me/cibsecurity/73904 · Telegram Post
• https://herolab.usd.de/en/security-advisories/usd-2022-0056 · Note