PT-2023-25053 · Topdesk · Topdesk

Char49 · Published 2023-06-22 · Updated 2023-06-30 · CVE-2023-34923

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TOPdesk version 12.10.12

Description The issue allows bad actors with credentials to authenticate with the Identity Provider to impersonate any TOPdesk user via SAML Response manipulation. This is due to XML Signature Wrapping (XSW) in the SAML-based Single Sign-on feature.

Recommendations For TOPdesk version 12.10.12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-34923

Affected Products

Topdesk

References · 6

• 🔥 https://char49.com/articles/topdesk-vulnerable-to-xml-signature-wrapping-attacks · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34923 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34923 · Vendor Advisory
• https://my.topdesk.com/tas/public/ssp/content/detail/knowledgeitem?unid=56a16ba1c2824e9a82655892ba75d3c0 · Note
• https://t.me/cibsecurity/65432 · Telegram Post
• https://t.me/cvenotify/52890 · Telegram Post