CVE-2023-44397: falha de alta gravidade em CloudExplorer-Dev CloudExplorer-Lite
CloudExplorer Lite permission bypass vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.7%
CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
CloudExplorer-Dev · CloudExplorer-LiteCVEs relacionadas — CloudExplorer-Dev CloudExplorer-Lite
No mesmo produto, das mais perigosas para as menos.
CVE-2023-38692CRITICALCommand injection vulnerability in module management function in CloudExplorer LiteEPSS 3.4%CVE-2023-39519HIGHCloudExplorer Lite sensitive information leakage vulnerabilityEPSS 0.8%CVE-2023-34240MEDIUMWeak passwords allowed in cloudexplorer-liteEPSS 0.5%CVE-2023-32316HIGHUsers can add themselves to any organization in CloudExplorer LiteEPSS 0.4%CVE-2023-32311HIGHThe CloudExplorer Lite missing permissions checkEPSS 0.4%