PT-2023-7628 · Asustor · Asustor Data Master

Stéphane Chauveau · Published 2023-08-22 · Updated 2023-08-28 · CVE-2023-3699

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 and below ASUSTOR Data Master (ADM) versions 4.1.0 and below ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below

Description The issue is related to improper privilege management in ASUSTOR Data Master (ADM), allowing an unprivileged local user to modify the configuration of storage devices.

Recommendations For ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 and below, update to a version above 4.0.6.RIS1 to resolve the issue. For ASUSTOR Data Master (ADM) versions 4.1.0 and below, update to a version above 4.1.0 to resolve the issue. For ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below, update to a version above 4.2.2.RI61 to resolve the issue.

Fix

Command Injection

Improper Privilege Management

Weakness Enumeration

CWE-77

CWE-269

Related Identifiers

BDU:2023-08688

CVE-2023-3699

Affected Products

Asustor Data Master

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3699 · Security Note
• https://bdu.fstec.ru/vul/2023-08688 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3699 · Vendor Advisory
• https://asustor.com/security/security_advisory_detail?id=29 · Vendor Advisory
• https://github.com/advisories/GHSA-phmm-962c-7vph · Note
• https://t.me/cvenotify/57460 · Telegram Post
• https://t.me/cibsecurity/69006 · Telegram Post