PT-2023-27876 · Plixer · Plixer Scrutinizer

Chris Bellows · Published 2023-10-12 · Updated 2023-10-16 · CVE-2023-41263

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer versions prior to 19.3.1

Description An issue was discovered in Plixer Scrutinizer that exposes debug logs to unauthenticated users at the "/debug/" URL path. With knowledge of valid IP addresses and source types, an unauthenticated attacker can download debug logs containing application-related information.

Recommendations For versions prior to 19.3.1, update to version 19.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/debug/" URL path until a patch is available.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-41263

Affected Products

Plixer Scrutinizer

References · 6

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-41263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41263 · Security Note
• https://twitter.com/VulmonFeeds/status/1712627317690765336 · Twitter Post
• https://twitter.com/CVEnew/status/1712596664676962756 · Twitter Post
• https://t.me/cibsecurity/72210 · Telegram Post