PT-2023-30261 · Unknown · Com.Phlox.Simpleserver.Plus

Published 2023-12-27 · Updated 2024-01-05 · CVE-2023-46918

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) version 1.8.1-plus

Description The Android manifest file of the affected software contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device.

Recommendations For version 1.8.1-plus, consider setting the android:allowBackup attribute to false in the Android manifest file to prevent potential exploitation. As a temporary workaround, restrict physical access to devices running the affected software until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-46918

Affected Products

Com.Phlox.Simpleserver.Plus

References · 7

• 🔥 https://github.com/actuator/com.phlox.simpleserver/blob/main/CWE-321.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-46918 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46918 · Vendor Advisory
• https://twitter.com/CVEnew/status/1740128521559667077 · Twitter Post
• https://t.me/cvenotify/65322 · Telegram Post
• https://t.me/cvenotify/65417 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1740153080014872626 · Twitter Post