PT-2023-25623 · Pos/ Dienstleistung · Cashit!

Daniel + 12 · Published 2023-10-03 · Updated 2024-02-10 · CVE-2023-3656

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cashIT! - serving solutions versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37

Description The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint exposed to the network.

Recommendations For versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37, as a temporary workaround, consider restricting access to the exposed HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-749

CWE-94

Related Identifiers

CVE-2023-3656

Affected Products

Cashit!

References · 10

• https://osv.dev/vulnerability/CVE-2023-3656 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3656 · Security Note
• https://twitter.com/jfrog/status/1756367425212162480 · Twitter Post
• https://t.me/cvenotify/65414 · Telegram Post
• https://twitter.com/CVEnew/status/1709114284481847309 · Twitter Post
• https://t.me/cvenotify/60359 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1709156947738398776 · Twitter Post
• https://t.me/cibsecurity/71465 · Telegram Post
• https://doi.org/10.35011/ww2q-d522 · Note
• https://cashit.at · Note