PT-2023-26052 · Unknown · Uvdesk Community Skeleton

Published 2023-10-23 · Updated 2023-10-30 · CVE-2023-37635

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UVDesk Community Skeleton version 1.1.1

Description The issue allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application. This can be done through the login page, allowing attackers to potentially gain unauthorized access.

Recommendations For UVDesk Community Skeleton version 1.1.1, consider implementing rate limiting or IP blocking on the login page to prevent brute force attacks until a patch is available. As a temporary workaround, restrict access to the login page to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-37635

Affected Products

Uvdesk Community Skeleton

References · 7

• 🔥 https://esecforte.com/cve-2023-37635-login-bruteforce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-37635 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37635 · Vendor Advisory
• https://t.me/cvenotify/60209 · Telegram Post
• https://twitter.com/CVEnew/status/1716563808406118535 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1716581483467755873 · Twitter Post
• https://t.me/cibsecurity/72801 · Telegram Post