PT-2023-25651 · Prolion+1 · Prolion Cryptospike+1

Published 2023-12-11 · Updated 2023-12-13 · CVE-2023-36648

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions ProLion CryptoSpike version 3.0.15P2

Description The issue is related to missing authentication in the internal data streaming system, allowing remote unauthenticated users to read potentially sensitive information and deny service to users. This is achieved by directly reading and writing data in Apache Kafka, where the attacker can act as both a consumer and a producer.

Recommendations For ProLion CryptoSpike version 3.0.15P2, consider implementing proper authentication mechanisms for the internal data streaming system to prevent unauthorized access. As a temporary workaround, restrict access to the Apache Kafka system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-36648

Affected Products

Apache Kafka

Prolion Cryptospike

References · 6

• 🔥 https://cvcn.gov.it/cvcn/cve/CVE-2023-36648 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36648 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36648 · Vendor Advisory
• https://twitter.com/CVEnew/status/1734379220522930279 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734494822558261381 · Twitter Post
• https://t.me/cvenotify/63600 · Telegram Post