PT-2023-23324 · Evasys · Evasys

Dipl-Ing. Mario Rubak + 1 · Published 2023-05-02 · Updated 2023-05-10 · CVE-2023-31435

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions evasys versions prior to 8.2 Build 2286 evasys versions 9.x prior to 9.0 Build 2401

Description The issue allows authenticated attackers to read and write to unauthorized data by accessing functions directly in multiple components, including Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews.

Recommendations For evasys versions prior to 8.2 Build 2286, update to version 8.2 Build 2286 or later. For evasys versions 9.x prior to 9.0 Build 2401, update to version 9.0 Build 2401 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-31435

Affected Products

Evasys

References · 5

• 🔥 https://cves.at/posts/cve-2023-31435/writeup · Exploit
• https://osv.dev/vulnerability/CVE-2023-31435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31435 · Security Note
• https://t.me/cibsecurity/63186 · Telegram Post
• https://t.me/cvenotify/50115 · Telegram Post