PT-2023-32496 · Esm · Esm

Andre Waldhoff + 1 · Published 2023-11-29 · Updated 2023-12-05 · CVE-2023-6070

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ESM versions prior to 11.6.8

Description A server-side request forgery issue allows a low-privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data.

Recommendations For versions prior to 11.6.8, update to version 11.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the certificate validation functionality to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-6070

Affected Products

Esm

References · 5

• https://osv.dev/vulnerability/CVE-2023-6070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6070 · Security Note
• https://kcm.trellix.com/corporate/index?page=content&id=SB10413 · Vendor Advisory
• https://t.me/cvenotify/62311 · Telegram Post
• https://t.me/cvenotify/61430 · Telegram Post