PT-2023-30184 · Obl.Ong · Obl.Ong

Zinc · Published 2023-10-25 · Updated 2023-11-07 · CVE-2023-46754

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Obl.ong versions prior to 1.1.2

Description The admin panel for Obl.ong allows authorization bypass because the email OTP feature accepts arbitrary numerical values.

Recommendations For versions prior to 1.1.2, update to version 1.1.2 or later to resolve the issue. As a temporary workaround, consider disabling the email OTP feature in the admin panel until a patch is available. Restrict access to the admin panel to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-46754

Affected Products

Obl.Ong

References · 6

• https://osv.dev/vulnerability/CVE-2023-46754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46754 · Security Note
• https://github.com/obl-ong/admin/releases/tag/v1.1.2 · Note
• https://t.me/cibsecurity/72940 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1717487797211136270 · Twitter Post
• https://twitter.com/CVEnew/status/1717404085966516544 · Twitter Post