PT-2023-4204 · Terrasoft · Creatio+1
Published
2023-08-08
·
Updated
2023-08-08
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:N/C:C/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Terrasoft (affected versions not specified)
Creatio (affected versions not specified)
Description
The issue is related to the ConnectionStrings.config component in Terrasoft CRM system and Creatio BPM system, where there is an incorrect restriction of the path name to a directory with limited access. This could allow a remote attacker to gain unauthorized access to protected information.
Recommendations
For Terrasoft, consider restricting access to the ConnectionStrings.config component until a fix is available.
For Creatio, avoid using the vulnerable ConnectionStrings.config component in sensitive operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Access Control
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Creatio
Terrasoft