PT-2023-29633 · Unknown · Engelsystem

Sev-Hack · Published 2023-10-16 · Updated 2023-10-30 · CVE-2023-45659

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Engelsystem (affected versions not specified)

Description Engelsystem is a shift planning system for chaos events. If a user's password is compromised and an attacker gains access to the user's account, the attacker's session is not terminated if the user's account password is reset.

Recommendations Update installations to a version that includes the fix committed in dbb089315ff3d. As a temporary workaround, consider implementing additional security measures to monitor and terminate suspicious sessions. Restrict access to sensitive areas of the system until the update is applied. There are no known workarounds for this issue, so updating is the recommended course of action.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-45659

GHSA-F6MM-3V2H-JM6X

Affected Products

Engelsystem

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45659.json · Exploit
• 🔥 https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x · Exploit
• https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-45659 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45659 · Vendor Advisory
• https://twitter.com/IT_securitynews/status/1715300166540955747 · Twitter Post
• https://t.me/cibsecurity/72409 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1714153633846095922 · Twitter Post
• https://twitter.com/CVEnew/status/1714066896243347811 · Twitter Post
• https://t.me/cvenotify/59557 · Telegram Post