PT-2023-29037 · Emsigner · Emsigner

Jean Paul Granados · Published 2023-11-13 · Updated 2023-11-17 · CVE-2023-43900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMSigner version 2.8.7

Description The issue allows attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters. This is due to Insecure Direct Object References (IDOR) in the application.

Recommendations For EMSigner version 2.8.7, consider restricting access to the documentID and EncryptedDocumentId parameters to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters in sensitive operations until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-43900

Affected Products

Emsigner

References · 5

• 🔥 https://secpro.llc/emsigner-cve-3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-43900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43900 · Security Note
• https://twitter.com/CVEnew/status/1724289183575875744 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1724320364669386757 · Twitter Post