PT-2025-1474 · Selesta · Selesta Visual Access Manager

Published 2025-01-13 · Updated 2025-01-31 · CVE-2023-42248

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager (VAM) versions prior to 4.42.2

Description An issue was discovered in Selesta Visual Access Manager (VAM) where an authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam Sql.php".

Recommendations For versions prior to 4.42.2, update to version 4.42.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "common/vam Sql.php" page until a patch is available. Avoid using manipulated POST parameters in the affected page until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-42248

Affected Products

Selesta Visual Access Manager

References · 6

• https://osv.dev/vulnerability/CVE-2023-42248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42248 · Security Note
• https://t.me/cvenotify/109487 · Telegram Post
• https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md · Note
• https://twitter.com/CVEnew/status/1878928250631520751 · Twitter Post
• https://t.me/cvedetector/15190 · Telegram Post