PT-2023-32620 · Tyler Technologies · Court Case Management Plus

Jason Parker · Published 2023-11-30 · Updated 2023-12-06 · CVE-2023-6344

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Court Case Management Plus (affected versions not specified) Tyler Technologies Court Case Management Plus (affected versions not specified)

Description The issue concerns insufficient permission checks in public court record platforms from multiple vendors, allowing unauthorized public access to sealed, confidential, and unreleased information. A specific instance involves Tyler Technologies Court Case Management Plus, where a remote, unauthenticated attacker can enumerate directories using the tiffserver/te003.aspx or te004.aspx API endpoints, specifically the ifolder parameter.

Recommendations For Court Case Management Plus, restrict access to the tiffserver/te003.aspx and te004.aspx API endpoints to prevent directory enumeration. For Tyler Technologies Court Case Management Plus, avoid using the ifolder parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-6344

Affected Products

Court Case Management Plus

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-6344 · Security Note
• https://aquaforest.com/blog/aquaforest-tiff-server-sunsetting · Vendor Advisory
• https://aquaforest.com/blog/tiff-server-security-update · Vendor Advisory
• https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md · Note
• https://twitter.com/VulmonFeeds/status/1730276299288027239 · Twitter Post
• https://twitter.com/CVEnew/status/1730296119165645229 · Twitter Post
• https://cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems · Note
• https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents · Note
• https://tylertech.com/solutions/courts-public-safety/courts-justice · Note
• https://t.me/cvenotify/62562 · Telegram Post