PT-2024-13976 · Selesta · Selesta Visual Access Manager

Andrea Carlo Maria Dattola + 4 · Published 2024-03-19 · Updated 2024-10-28 · CVE-2023-50811

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SELESTA Visual Access Manager version 4.38.6

Description An issue in SELESTA Visual Access Manager allows attackers to modify the computer POST parameter related to the ID of a specific reception by POST HTTP request interception. This can lead to unauthorized access to the application and control of many other receptions beyond the assigned one. The issue can be exploited via local network only.

Recommendations For SELESTA Visual Access Manager version 4.38.6, restrict local network access and monitor logs until a patch is available. As a temporary workaround, consider restricting access to the computer POST parameter to minimize the risk of exploitation.

Fix

Incorrect Authorization

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-863

CWE-444

Related Identifiers

CVE-2023-50811

Affected Products

Selesta Visual Access Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-50811 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50811 · Vendor Advisory
• https://twitter.com/CVEnew/status/1770206751201083395 · Twitter Post
• https://t.me/cvenotify/99797 · Telegram Post
• https://gruppotim.it/it/footer/red-team.html · Note
• https://twitter.com/VulmonFeeds/status/1770246602118062335 · Twitter Post
• https://t.me/cvenotify/78459 · Telegram Post
• https://twitter.com/oktsec/status/1770813066306891977 · Twitter Post