PT-2024-13067 · Clarisa · Filemaker Server

Published 2024-03-21 · Updated 2024-12-09 · CVE-2023-42954

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FileMaker Server versions prior to 20.3.1

Description A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed by reducing the information sent in requests.

Recommendations For versions prior to 20.3.1, update to FileMaker Server 20.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the Admin Console to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2023-42954

Affected Products

Filemaker Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-42954 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42954 · Vendor Advisory
• https://support.claris.com/s/answerview?anum=000041424&language=en_US · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1770972110678073422 · Twitter Post
• https://twitter.com/CVEnew/status/1770943618338943077 · Twitter Post
• https://t.me/cvenotify/74386 · Telegram Post
• https://t.me/cvenotify/103563 · Telegram Post