PT-2023-8849 · Openrapid+1 · Openrapid Rapidcms+1

Txph · Published 2023-08-20 · Updated 2024-05-17 · CVE-2023-4448

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenRapid RapidCMS version 1.3.1

Description A critical issue affects the processing of the file admin/run-movepass.php, where the manipulation of the password and password2 arguments leads to weak password recovery. The attack can be initiated remotely.

Recommendations For OpenRapid RapidCMS version 1.3.1, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the admin/run-movepass.php file until a patch is available. Avoid using the password and password2 arguments in the affected file until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

BDU:2024-02408

CVE-2023-4448

Affected Products

Openrapid Rapidcms

Red Os

References · 11

• 🔥 https://github.com/OpenRapid/rapidcms/issues/5 · Exploit
• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbe#diff-fc57d4c69cf5912c6edb5233c6df069a91106ebd481c115faf1ea124478b26d0 · Patch
• https://osv.dev/vulnerability/CVE-2023-4448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4448 · Security Note
• https://bdu.fstec.ru/vul/2024-02408 · Security Note
• https://vuldb.com/?id.237569 · Note
• https://t.me/cvenotify/56966 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-cri-o-cve-2022-2995-cve-2023-39325-cve-2023-4448 · Note
• https://t.me/cvenotify/57287 · Telegram Post
• https://vuldb.com/?ctiid.237569 · Note