PT-2023-29319 · Unknown · Easy Chat Server

Rafael Pedrero · Published 2023-10-04 · Updated 2023-10-06 · CVE-2023-4494

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Chat Server version 3.1

Description A stack-based buffer overflow issue exists due to an excessively long username string being sent to the "register.ghp" file via a GET request, potentially leading to arbitrary code execution on the remote machine.

Recommendations For Easy Chat Server version 3.1, consider restricting access to the "register.ghp" file to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the length of the username string to prevent buffer overflow.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2023-4494

Affected Products

Easy Chat Server

References · 6

• https://osv.dev/vulnerability/CVE-2023-4494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4494 · Security Note
• https://t.me/cvenotify/58972 · Telegram Post
• https://twitter.com/cracbot/status/1710075091504275746 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products · Note
• https://t.me/cibsecurity/71578 · Telegram Post