PT-2023-28730 · Submitty · Submitty

Richcfno1 · Published 2023-11-02 · Updated 2023-11-10 · CVE-2023-43194

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Submitty versions prior to 22.06.00

Description The issue allows an attacker to delete any post in the forum by modifying a request parameter, due to incorrect access control. This can be achieved by altering the request parameter, although the specific parameter name is not provided. The attack vector involves manipulating this parameter to gain unauthorized access to post deletion functionality.

Recommendations For versions prior to 22.06.00, update to version 22.06.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the forum post deletion functionality until a patch is applied. Avoid using modified request parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-43194

Affected Products

Submitty

References · 7

• 🔥 https://fuchai.net/cve/CVE-2023-43194 · Exploit
• https://github.com/Submitty/Submitty/pull/8032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43194 · Security Note
• https://twitter.com/VulmonFeeds/status/1720241526591107508 · Twitter Post
• https://twitter.com/CVEnew/status/1720193575391048126 · Twitter Post
• https://t.me/cvenotify/60430 · Telegram Post