PT-2023-26557 · Unknown · Cloudexplorer Lite

Hbdxmz · Published 2023-08-04 · Updated 2023-08-09 · CVE-2023-38692

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudExplorer Lite versions prior to 1.3.1

Description The issue concerns a command injection vulnerability in the installation function within the module management of CloudExplorer Lite, an open-source cloud management platform. This vulnerability has been fixed in version 1.3.1. There are no known workarounds aside from upgrading to the fixed version.

Recommendations For versions prior to 1.3.1, upgrade to version 1.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the module management installation function until the upgrade can be applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-38692

GHSA-7WRC-F42M-9V5W

Affected Products

Cloudexplorer Lite

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38692.json · Exploit
• 🔥 https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-7wrc-f42m-9v5w · Exploit
• https://osv.dev/vulnerability/CVE-2023-38692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38692 · Security Note
• https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.3.1 · Note
• https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/blob/v1.3.0/framework/management-center/backend/src/main/java/com/fit2cloud/controller/ModuleManageController.java · Note
• https://t.me/cibsecurity/67792 · Telegram Post