PT-2023-28319 · Unknown · Fl3Xx Dispatch+1

Published 2023-09-20 · Updated 2023-09-22 · CVE-2023-42334

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fl3xx Dispatch version 2.10.37 fl3xx Crew version 2.10.37

Description An Indirect Object Reference (IDOR) issue allows a remote attacker to escalate privileges via the user parameter. This enables the attacker to potentially gain unauthorized access to sensitive information or perform actions that would normally be restricted.

Recommendations For Fl3xx Dispatch version 2.10.37, consider disabling the functionality that utilizes the user parameter until a patch is available. For fl3xx Crew version 2.10.37, restrict access to the component that uses the user parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-42334

Affected Products

Fl3Xx Dispatch

Fl3Xx Crew

References · 8

• 🔥 https://0xhunter20.medium.com/an-idor-lead-to-viewing-other-users-files-cve-2023-42334-702de328c453 · Exploit
• https://osv.dev/vulnerability/CVE-2023-42334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42334 · Security Note
• https://t.me/cibsecurity/70844 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704630424369340660 · Twitter Post
• https://t.me/cvenotify/58364 · Telegram Post
• https://twitter.com/CVEnew/status/1704580692674257286 · Twitter Post
• https://t.me/cvenotify/58220 · Telegram Post