PT-2023-29052 · Dromara · Dromara Satoken

M4Ra7H0N · Published 2023-10-13 · Updated 2024-09-11 · CVE-2023-43961

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dromara SaToken versions 1.3.50RC and earlier

Description An issue in Dromara SaToken when using Spring dynamic controllers may cause an authentication bypass due to a specially crafted request.

Recommendations For Dromara SaToken versions 1.3.50RC and earlier, update to a version later than 1.3.50RC to resolve the issue. As a temporary workaround, consider restricting access to Spring dynamic controllers until a patch is available.

Exploit

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

CVE-2023-43961

GHSA-W9VH-HV5G-7WMR

Affected Products

Dromara Satoken

References · 9

• 🔥 https://github.com/dromara/Sa-Token/issues/511 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43961 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43961 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w9vh-hv5g-7wmr · Vendor Advisory
• https://github.com/dromara/Sa-Token · Note
• https://twitter.com/VulmonFeeds/status/1713038577888575947 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1713038324787449975 · Twitter Post
• https://twitter.com/CVEnew/status/1717056727424934296 · Twitter Post
• https://t.me/cvenotify/94259 · Telegram Post