PT-2023-25634 · Basecamp · Com.Basecamp.Bc3

Fr4Via · Published 2023-06-25 · Updated 2023-06-30 · CVE-2023-36612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.basecamp.bc3 versions prior to 4.2.1

Description Directory traversal can occur in the com.basecamp.bc3 application, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses, containing sensitive information, to third-party applications by using a custom-crafted deeplink scheme.

Recommendations For versions prior to 4.2.1, update to version 4.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom-crafted deeplink schemes to minimize the risk of exploitation. Avoid using malicious intents that could redirect server responses to third-party applications until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-36612

Affected Products

Com.Basecamp.Bc3

References · 6

• 🔥 https://hackerone.com/reports/1710541 · Exploit
• https://osv.dev/vulnerability/CVE-2023-36612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36612 · Security Note
• https://t.me/cibsecurity/65492 · Telegram Post
• https://t.me/cvenotify/53024 · Telegram Post
• https://t.me/cvenotify/53464 · Telegram Post