CVE-2023-28346

Опубликовано: 31 мая 2023

Источник: nvd

CVSS3: 7.3

EPSS Низкий

Описание

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact with private pages on the web server, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials.

Ссылки

https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Exploit
Mitigation
Release Notes
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Third Party Advisory
https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Exploit
Mitigation
Release Notes
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 25%

0.00085

Низкий

7.3 High

CVSS3

Дефекты

CWE-732

Связанные уязвимости

GHSA-8mgq-4w2r-2f8j

CVSS3: 7.3

github

больше 2 лет назад

BDU:2023-02979

CVSS3: 3.5

fstec

около 3 лет назад

Уязвимость компонента Student Console платформы управления компьютерными сетями в образовании Faronics Insight, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных