PT-2023-25885 · Unknown · Smartbpm.Net

Alan Chung · Published 2023-07-10 · Updated 2023-07-13 · CVE-2023-37288

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmartBPM.NET (affected versions not specified)

Description The issue concerns a path traversal vulnerability within the file download function of SmartBPM.NET, allowing an unauthenticated remote attacker to access arbitrary system files. Additionally, there is a vulnerability related to the use of a hard-coded authentication key, which can be exploited by an unauthenticated remote attacker to access the system with regular user privileges, enabling them to read application data and execute submission and approval processes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2023-37288

Affected Products

Smartbpm.Net

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-37288 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37288 · Vendor Advisory
• https://t.me/cibsecurity/66241 · Telegram Post
• https://t.me/cvenotify/53939 · Telegram Post
• https://twcert.org.tw/tw/cp-132-7223-af8f8-1.html · Note
• https://t.me/cvenotify/53955 · Telegram Post