PT-2024-13701 · Stilog · Stilog Visual Planning

David Brown + 1 · Published 2024-03-29 · Updated 2024-08-01 · CVE-2023-49232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stilog Visual Planning version 8

Description An authentication bypass issue was found, allowing an unauthenticated attacker to brute-force the password reset PINs of administrative users.

Recommendations For Stilog Visual Planning version 8, consider temporarily restricting access to the password reset functionality until a patch is available. As a mitigation measure, limit the number of attempts to reset the PIN to prevent brute-force attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-49232

Affected Products

Stilog Visual Planning

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-49232 · Security Note
• https://t.me/cvenotify/75844 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1773782115731030119 · Twitter Post
• https://schutzwerk.com/advisories/SCHUTZWERK-SA-2023-004.txt · Note
• https://schutzwerk.com/blog/schutzwerk-sa-2023-004 · Note
• https://twitter.com/CVEnew/status/1773842630545465563 · Twitter Post
• https://visual-planning.com/en/support-portal/updates · Note
• http://seclists.org/fulldisclosure/2024/Apr/2 · Note
• https://t.me/cvenotify/75150 · Telegram Post