PT-2023-30298 · Totvs · Totvs Rm

Chor4O · Published 2023-09-01 · Updated 2024-05-17 · CVE-2023-4709

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TOTVS RM version 12.1

Description A problematic vulnerability has been found in the Portal component of TOTVS RM, specifically in the Login.aspx file. The issue arises from the manipulation of the VIEWSTATE argument, leading to cross-site scripting. This vulnerability can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For TOTVS RM version 12.1, as a temporary workaround, consider restricting access to the Login.aspx file or disabling the manipulation of the VIEWSTATE argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2023-4709

Affected Products

Totvs Rm

References · 7

• https://osv.dev/vulnerability/CVE-2023-4709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4709 · Security Note
• https://vuldb.com/?submit.196885 · Note
• https://t.me/cibsecurity/69681 · Telegram Post
• https://tdn.totvs.com/pages/releaseview.action?pageId=284462425#COMOAUMENTARASEGURAN%C3%87ADESUAAPLICA%C3%87%C3%83O-Reduziron%C3%ADveldedetalhamentodemensagensexibidasparaousu%C3%A1rio · Note
• https://vuldb.com/?ctiid.238572 · Note
• https://vuldb.com/?id.238572 · Note