PT-2024-2331 · Unknown · Siveillance Control

Published 2024-03-12 · Updated 2024-03-12 · CVE-2023-45793

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Siveillance Control versions 2.8 through 3.1.1

Description A vulnerability has been identified in the affected product, related to insufficient checks on the list of access groups assigned to individual users. This could enable a locally logged on user to gain write privileges for objects where they only have read privileges. The issue is associated with deficiencies in the authorization mechanism, which could allow an attacker to obtain write access to objects for which they only had read access.

Recommendations For versions 2.8 through 3.1.1, update to version 3.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive objects to minimize the risk of exploitation. Additionally, review and adjust access group assignments to ensure that users do not have unnecessary privileges.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-02273

CVE-2023-45793

Affected Products

Siveillance Control

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-45793 · Security Note
• https://bdu.fstec.ru/vul/2024-02273 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45793 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-145196.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1767498448105083324 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767527538698457496 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024031303 · Note