PT-2023-29763 · Unknown · Wpn-Xm Serverstack

Rafael Pedrero · CVE-2023-4591 · Published 2023-11-03 · Updated 2023-11-13

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPN-XM Serverstack version 0.8.6

Description A local file inclusion issue has been found, allowing an unauthenticated user to perform a local file inclusion via the "/tools/webinterface/index.php?page" parameter by sending a GET request. This could lead to the loading of a PHP file on the server, resulting in a critical webshell exploit.

Recommendations For version 0.8.6, consider disabling the index.php page in the /tools/webinterface/ directory until a patch is available. Restrict access to the page parameter in the affected API endpoint to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2023-4591

Affected Products

Wpn-Xm Serverstack

References · 5

• https://osv.dev/vulnerability/CVE-2023-4591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4591 · Security Note
• https://t.me/cibsecurity/73513 · Telegram Post
• https://twitter.com/CVEnew/status/1720398988195586147 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack · Note