PT-2023-32362 · Columbiasoft · Columbiasoft Document Locator

Matt Biedronski + 2 · Published 2023-10-27 · Updated 2025-03-14 · CVE-2023-5830

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColumbiaSoft Document Locator versions prior to 7.2 SP4 and 2021.1

Description A critical vulnerability has been found in ColumbiaSoft Document Locator, affecting an unknown part of the file "/api/authentication/login" of the component WebTools. The manipulation of the Server argument leads to improper authentication. It is possible to initiate the attack remotely.

Recommendations For versions prior to 7.2 SP4, upgrade to version 7.2 SP4 to address this issue. For versions prior to 2021.1, upgrade to version 2021.1 to address this issue. As a temporary workaround, consider restricting access to the "/api/authentication/login" endpoint until a patch is available. Avoid using the Server argument in the affected API endpoint until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-5830

Affected Products

Columbiasoft Document Locator

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-5830 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5830 · Vendor Advisory
• https://twitter.com/Gonski47/status/1763270252354326815 · Twitter Post
• https://twitter.com/CVEnew/status/1718004200506880450 · Twitter Post
• https://vuldb.com/?id.243729 · Note
• https://twitter.com/Gonski47/status/1771968541039681637 · Twitter Post
• https://t.me/thehackernews/6480 · Telegram Post
• https://t.me/true_secator/6843 · Telegram Post
• https://vuldb.com/?ctiid.243729 · Note
• https://twitter.com/Gonski47/status/1770074136829694077 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1718033506880635276 · Twitter Post