PT-2023-29750 · Unknown · Floorsight Insights

Published 2023-12-11 · Updated 2024-01-08 · CVE-2023-45892

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Floorsight Insights version Q3 2023

Description An issue in the Order and Invoice pages allows an unauthenticated remote attacker to view sensitive customer information.

Recommendations For Floorsight Insights version Q3 2023, consider restricting access to the Order and Invoice pages until a fix is available. As a temporary workaround, limit the information displayed on these pages to minimize the risk of sensitive data exposure. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-45892

Affected Products

Floorsight Insights

References · 6

• 🔥 https://github.com/Oracle-Security/CVEs/blob/main/FloorsightSoftware/CVE-2023-45892.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-45892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45892 · Security Note
• https://twitter.com/CVEnew/status/1742284328854323280 · Twitter Post
• https://t.me/cibsecurity/74198 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734323920881295653 · Twitter Post