PT-2023-4580 · Iagona · Iagona Scrutisweb

Jorian Van Den Hout + 2 · Published 2023-07-18 · Updated 2023-08-16 · CVE-2023-33871

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Iagona ScrutisWeb versions 2.1.37 and prior

Description The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to gain direct access to any arbitrary file outside the webroot. Researchers found several flaws in the ScrutisWeb ATM fleet monitoring software that can expose ATMs to hacking.

Recommendations For Iagona ScrutisWeb versions 2.1.37 and prior, update to a version later than 2.1.37 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories outside the webroot to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

BDU:2023-04987

CVE-2023-33871

Affected Products

Iagona Scrutisweb

References · 8

• https://osv.dev/vulnerability/CVE-2023-33871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33871 · Security Note
• https://bdu.fstec.ru/vul/2023-04987 · Security Note
• https://twitter.com/raasangandhi/status/1691166932546764800 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-199-03 · Note
• https://twitter.com/shah_sheikh/status/1691365622779990017 · Twitter Post
• https://t.me/echeloneyes/1854 · Telegram Post
• https://twitter.com/fletch_ai/status/1691602419573006381 · Twitter Post