PT-2023-6721 · Iagona · Iagona Scrutisweb

Jorian Van Den Hout + 2 · Published 2023-07-18 · Updated 2023-08-16 · CVE-2023-38257

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Iagona ScrutisWeb versions 2.1.37 and prior

Description The issue is related to an insecure direct object reference vulnerability. This could allow an unauthenticated user to view profile information, including user login names and encrypted passwords. The vulnerability is associated with an error in processing user-controlled authorization keys.

Recommendations For Iagona ScrutisWeb versions 2.1.37 and prior, update to a version later than 2.1.37 to resolve the issue. As a temporary workaround, consider restricting access to profile information to minimize the risk of exploitation. Avoid using the vulnerable profile information endpoint until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2023-07494

CVE-2023-38257

Affected Products

Iagona Scrutisweb

References · 9

• https://osv.dev/vulnerability/CVE-2023-38257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38257 · Security Note
• https://bdu.fstec.ru/vul/2023-07494 · Security Note
• https://t.me/cvenotify/55438 · Telegram Post
• https://twitter.com/raasangandhi/status/1691166932546764800 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-199-03 · Note
• https://t.me/echeloneyes/1854 · Telegram Post
• https://twitter.com/fletch_ai/status/1691602419573006381 · Twitter Post
• https://t.me/cibsecurity/66936 · Telegram Post