PT-2023-27709 · Aurea · Arconte Áurea

Jorge Alberto Palma Reyes + 1 · Published 2023-09-19 · Updated 2023-09-21 · CVE-2023-4094

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions ARCONTE Aurea version 1.5.0.0

Description The authentication system could allow an attacker to make incorrect access requests, blocking each legitimate account and causing a denial of service. A resource has been identified that could allow circumventing the attempt limit set in the login form.

Recommendations For version 1.5.0.0, consider restricting access to the login form to minimize the risk of exploitation. As a temporary workaround, limit the number of incorrect access requests to prevent denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

CWE-1390

Related Identifiers

CVE-2023-4094

Affected Products

Arconte Áurea

References · 6

• https://osv.dev/vulnerability/CVE-2023-4094 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fujitsu-arconte-aurea · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4094 · Security Note
• https://twitter.com/CVEnew/status/1704128090421760437 · Twitter Post
• https://t.me/cvenotify/58335 · Telegram Post
• https://t.me/cibsecurity/70729 · Telegram Post