PT-2023-27497 · Broadpeak · Broadpeak Centralized Accounts Management Auth Agent

Published 2023-10-03 · Updated 2023-10-05 · CVE-2023-40519

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Broadpeak Centralized Accounts Management Auth Agent versions 00.12.01.9565588 1254b459, 01.01.00.19219575 ee9195b0, 01.01.01.30097902 fd999e76

Description A cross-site scripting (XSS) issue in the bpk-common/auth/login/index.html login portal allows remote attackers to inject arbitrary web script or HTML via the disconnectMessage parameter. This enables attackers to potentially execute malicious scripts on the client-side.

Recommendations For Broadpeak Centralized Accounts Management Auth Agent versions 00.12.01.9565588 1254b459, 01.01.00.19219575 ee9195b0, 01.01.01.30097902 fd999e76, consider restricting access to the disconnectMessage parameter in the login portal to minimize the risk of exploitation. As a temporary workaround, avoid using the disconnectMessage parameter in the affected login portal until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-40519

Affected Products

Broadpeak Centralized Accounts Management Auth Agent

References · 4

• https://osv.dev/vulnerability/CVE-2023-40519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40519 · Security Note
• https://t.me/cibsecurity/71530 · Telegram Post
• https://medium.com/munchy-bytes/security-disclosure-of-vulnerabilities-cve-2023-40519-2fc319737dfa · Note