PT-2025-1550 · Crocoblock · Crocoblock Jetengine

Rafie Muhammad · Published 2025-01-02 · Updated 2025-01-03 · CVE-2023-48758

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Crocoblock JetEngine versions 3.2.4 and earlier

Description A Missing Authorization vulnerability is present in Crocoblock JetEngine, allowing attackers to exploit incorrectly configured access control security levels. This issue enables unauthorized access exploitation.

Recommendations For versions 3.2.4 and earlier, update to a version later than 3.2.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of JetEngine to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-48758

Affected Products

Crocoblock Jetengine

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-48758 · Security Note
• https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1874830604707221660 · Twitter Post
• https://twitter.com/bluepinksec/status/1874989998895722928 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1874962321522499949 · Twitter Post
• https://t.me/cvedetector/14164 · Telegram Post