PT-2023-25758 · Adm · Adm

Published 2023-08-17 · Updated 2023-08-23 · CVE-2023-3697

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADM versions 4.0.6.RIS1, 4.1.0 and below ADM versions 4.2.2.RI61 and below

Description The printer service fails to adequately handle user input, allowing remote unauthorized users to navigate beyond the intended directory structure and create files.

Recommendations For ADM versions 4.0.6.RIS1, 4.1.0 and below, update to a version above 4.1.0 to resolve the issue. For ADM versions 4.2.2.RI61 and below, update to a version above 4.2.2.RI61 to resolve the issue. As a temporary workaround, consider restricting access to the printer service to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-3697

Affected Products

Adm

References · 7

• https://asustor.com/security/security_advisory_detail?id=28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3697 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3697 · Vendor Advisory
• https://t.me/cvenotify/56731 · Telegram Post
• https://t.me/cvenotify/56732 · Telegram Post
• https://twitter.com/cracbot/status/1692416116566733087 · Twitter Post
• https://t.me/cibsecurity/68740 · Telegram Post