PT-2023-26380 · Minitool · Minitool Power Data Recovery

0Dr3F · Published 2023-09-10 · Updated 2023-10-13 · CVE-2023-38353

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MiniTool Power Data Recovery versions 11.6 and before MiniTool Power Data Recovery version 11.5

Description The issue concerns an insecure in-app payment system in MiniTool Power Data Recovery, which can be exploited through a man-in-the-middle attack, allowing attackers to steal highly sensitive information.

Recommendations For MiniTool Power Data Recovery versions 11.6 and before, update to a version later than 11.6 to resolve the issue. For MiniTool Power Data Recovery version 11.5, update to a version later than 11.5 to resolve the issue. As a temporary workaround, consider disabling the in-app payment system until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2023-38353

Affected Products

Minitool Power Data Recovery

References · 8

• https://osv.dev/vulnerability/CVE-2023-38353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38353 · Security Note
• https://twitter.com/VulmonFeeds/status/1704202655193550885 · Twitter Post
• https://twitter.com/CVEnew/status/1704161786478383498 · Twitter Post
• https://t.me/cvenotify/58449 · Telegram Post
• https://twitter.com/0Dr3f/status/1700952645253410913 · Twitter Post
• https://0dr3f.github.io/cve · Note
• https://t.me/cibsecurity/70738 · Telegram Post