PT-2023-31463 · Unknown · Foundation

Published 2023-12-25 · Updated 2024-08-01 · CVE-2023-50053

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Foundation platform version 1.0

Description The issue allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation. The signed message lacks a nonce, which is a random number. This flaw may expose sensitive data due to a weakness in the Message Handler component.

Recommendations For Foundation platform version 1.0, apply available patches to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of the Web3 authentication process until a patch is available. Identify affected systems and monitor for signs of exploitation.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2023-50053

Affected Products

Foundation

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-50053 · Security Note
• https://twitter.com/VulmonFeeds/status/1739280562697732342 · Twitter Post
• https://twitter.com/CVEnew/status/1785381722801979835 · Twitter Post
• https://github.com/d0scoo1/Web3AuthRA · Note
• https://twitter.com/oktsec/status/1785452285469806621 · Twitter Post