PT-2023-28963 · Zultys · Mx-E+5

Stephen Breen · Published 2023-12-07 · Updated 2023-12-13 · CVE-2023-43743

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 versions prior to 17.0.10 patch 17161 and 16.04 patch 16109

Description A SQL injection issue allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to the "/newapi/" endpoint in the Zultys MX web interface.

Recommendations For versions prior to 17.0.10 patch 17161, update to version 17.0.10 patch 17161 or later. For versions prior to 16.04 patch 16109, update to version 16.04 patch 16109 or later. As a temporary workaround, consider restricting access to the "/newapi/" endpoint until a patch is available. Avoid using the filter parameter in requests to the "/newapi/" endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-43743

Affected Products

Mx-E

Mx-Se Ii

Mx-Virtual

Mx250

Mx30

Zultys Mx-Se

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-43743 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43743 · Vendor Advisory
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0002.md · Note
• https://twitter.com/CVEnew/status/1732944828483146070 · Twitter Post
• https://t.me/cvenotify/62852 · Telegram Post
• https://t.me/cvenotify/63484 · Telegram Post
• https://mxvirtual.com · Note
• https://twitter.com/VulmonFeeds/status/1733011989306171538 · Twitter Post