PT-2023-25760 · Adm · Adm

Published 2023-08-17 · Updated 2023-08-23 · CVE-2023-3698

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADM versions 4.0.6.RIS1 through 4.1.0 ADM versions 4.2.2.RI61 and below

Description The printer service fails to adequately handle user input, allowing remote unauthorized users to navigate beyond the intended directory structure and delete files.

Recommendations For ADM versions 4.0.6.RIS1 through 4.1.0, update to a version above 4.1.0 to resolve the issue. For ADM versions 4.2.2.RI61 and below, update to a version above 4.2.2.RI61 to resolve the issue. As a temporary workaround, consider restricting access to the printer service to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-3698

Affected Products

Adm

References · 6

• https://osv.dev/vulnerability/CVE-2023-3698 · Vendor Advisory
• https://asustor.com/security/security_advisory_detail?id=28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3698 · Security Note
• https://twitter.com/cracbot/status/1692416118097690872 · Twitter Post
• https://t.me/cibsecurity/68745 · Telegram Post
• https://t.me/cvenotify/56728 · Telegram Post