PT-2024-13702 · Unknown · Visual Planning Admin Center

David Brown + 1 · Published 2024-09-03 · Updated 2024-10-24 · CVE-2023-49233

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Visual Planning Admin Center 8 versions prior to v.1 Build 240207

Description The issue is related to insufficient access checks, allowing attackers with non-administrative accounts to utilize functions normally reserved for administrators. This can lead to the obtainment of different types of configured credentials and potentially elevate their privileges to administrator level.

Recommendations For versions prior to v.1 Build 240207, update to version v.1 Build 240207 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-49233

Affected Products

Visual Planning Admin Center

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-49233 · Security Note
• https://visual-planning.com/en/support-portal/updates · Note
• https://twitter.com/CVEnew/status/1831018079632887903 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1831038589829890159 · Twitter Post
• https://twitter.com/cracbot/status/1832660225415114895 · Twitter Post
• https://t.me/cvedetector/4702 · Telegram Post
• https://t.me/cvenotify/93082 · Telegram Post
• https://schutzwerk.com/blog/schutzwerk-sa-2023-005 · Note