PT-2023-32769 · Unknown · Amazing Little Poll

David Utón Amaya + 1 · Published 2023-12-13 · Updated 2023-12-22 · CVE-2023-6768

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazing Little Poll versions 1.3 through 1.4

Description The issue allows an unauthenticated user to access the admin panel without providing any credentials by accessing the "lp admin.php?adminstep=" parameter. This could enable unauthorized access to sensitive areas of the application.

Recommendations For versions 1.3 and 1.4, consider restricting access to the "lp admin.php?adminstep=" parameter until a patch is available. As a temporary workaround, avoid using the adminstep parameter in the "lp admin.php" endpoint to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-6768

Affected Products

Amazing Little Poll

References · 7

• https://osv.dev/vulnerability/CVE-2023-6768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6768 · Security Note
• https://twitter.com/VulmonFeeds/status/1737436025188745339 · Twitter Post
• https://t.me/cvenotify/64365 · Telegram Post
• https://twitter.com/CVEnew/status/1737416054102766027 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll · Note
• https://twitter.com/David_Uton/status/1734985279310569888 · Twitter Post