PT-2024-15259 · Unknown · Naukowa I Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy Ezd Rp

Published 2024-08-07 · Updated 2024-09-06 · CVE-2023-7265

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP versions prior to 15.84 Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP versions prior to 16.15 Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP versions prior to 17.2

Description The issue affects the user management system, allowing a logged-in user to change the password of any user, including the root user, which could lead to privilege escalation. Successful exploitation of this vulnerability may affect availability.

Recommendations For versions prior to 15.84, update to version 15.84 or later to resolve the issue. For versions prior to 16.15, update to version 16.15 or later to resolve the issue. For versions prior to 17.2, update to version 17.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2023-7265

Affected Products

Naukowa I Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy Ezd Rp

References · 10

• https://osv.dev/vulnerability/CVE-2023-7265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7265 · Security Note
• https://consumer.huawei.com/en/support/bulletin/2024/8 · Vendor Advisory
• https://t.me/cvenotify/91930 · Telegram Post
• https://t.me/cvenotify/89614 · Telegram Post
• https://t.me/cvenotify/89882 · Telegram Post
• https://t.me/cvenotify/91929 · Telegram Post
• https://t.me/cvedetector/2760 · Telegram Post
• https://t.me/cvenotify/93591 · Telegram Post
• https://t.me/cvenotify/91931 · Telegram Post