PT-2023-23997 · Pydio · Pydio Cells

Published 2023-05-30 · Updated 2025-01-06 · CVE-2023-32749

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pydio Cells (affected versions not specified)

Description The issue allows users to assign arbitrary roles to newly created external users by modifying the HTTP request during the creation process. This can grant access to all cells and non-personal workspaces if all roles are assigned to the new user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-32749

Affected Products

Pydio Cells

References · 9

• 🔥 http://seclists.org/fulldisclosure/2023/May/18 · Exploit
• 🔥 http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/51496 · Exploit
• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignments · Exploit
• https://osv.dev/vulnerability/CVE-2023-32749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32749 · Security Note
• https://t.me/defcon_news/114258 · Telegram Post
• https://t.me/rnetsec/18764 · Telegram Post
• https://redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses · Note