CVE-2023-6342mediumCWE-287

Tyler Technologies Court Case Management Plus "pay for print" allows authentication bypass

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 1.1%

probabilidade de exploração

1.1%top 35% das CVEs

exploração observada

nãonenhuma fonte reporta

Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 'payforprint_CM/Redirector.ashx?userid=' parameters. The vulnerable "pay for print" feature was removed on or around 2023-11-01.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Produtos afetados

Tyler Technologies · Court Case Management Plus

Referências

https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems https://www.tylertech.com/solutions/courts-public-safety/courts-justice