PT-2023-31801 · Unknown · Sandbox Accounts For Events

Mahmoud0X00 · Published 2023-12-22 · Updated 2024-01-04 · CVE-2023-51386

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sandbox Accounts for Events versions prior to 1.10.0

Description The issue allows authenticated users to potentially read data from the events table by sending request payloads to the "events API", collecting information on planned events, timeframes, budgets, and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider restricting access to the "events API" to minimize the risk of exploitation. Avoid using the events API to collect sensitive information until the issue is resolved.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-51386

GHSA-P7W3-J66H-M7MX

Affected Products

Sandbox Accounts For Events

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51386.json · Exploit
• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-51386 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51386 · Vendor Advisory
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mx · Note
• https://twitter.com/CVEnew/status/1738322047468458257 · Twitter Post
• https://twitter.com/cracbot/status/1738624164762726640 · Twitter Post
• https://t.me/cvenotify/65008 · Telegram Post