PT-2024-12897 · Softwarex · Softwarex

Published 2024-02-06 · Updated 2024-02-13 · CVE-2023-40545

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftwareX version 11.3

Description The issue is related to authentication bypass when an OAuth2 Client uses client secret jwt as its authentication method. This can be exploited via specially crafted requests.

Recommendations For version 11.3, consider disabling the use of client secret jwt as an authentication method until a patch is available. Restrict access to the OAuth2 Client to minimize the risk of exploitation. Avoid using specially crafted requests in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-40545

Affected Products

Softwarex

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-40545 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40545 · Vendor Advisory
• https://twitter.com/CVEnew/status/1754922259456671752 · Twitter Post
• https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass · Note
• https://twitter.com/VulmonFeeds/status/1754952086427427093 · Twitter Post
• https://pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html · Note
• https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 · Note
• https://t.me/cvenotify/70340 · Telegram Post