PT-2023-27900 · Softwarex · Softwarex

Mingyu Chen · Published 2023-12-18 · Updated 2023-12-22 · CVE-2023-41314

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 2.0.3

Description The issue allows unauthenticated access through the API endpoints "/api/snapshot" and "/api/get log file". This could potentially lead to a DoS attack or allow an attacker to retrieve arbitrary files from the FE node.

Recommendations For versions prior to 2.0.3, upgrade to version 2.0.3 to fix the issue. As a temporary workaround, consider restricting access to the "/api/snapshot" and "/api/get log file" API endpoints to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-41314

Affected Products

Softwarex

References · 4

• https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41314 · Security Note
• https://t.me/cvenotify/64927 · Telegram Post