CVE-2023-41356 - OpenCVE

NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Wisdomgarden	Tronclass Ilearn

Configuration 1 [-]

cpe:2.3:a:wisdomgarden:tronclass_ilearn:1.62.41849:hotfix-v1-62-84ccf1a5:*:*:*:*:*:*

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-7506-b4e29-1.html	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: twcert

Published: 2023-11-03T06:18:37.853Z

Updated: 2023-11-03T06:18:37.853Z

Reserved: 2023-08-29T00:14:47.636Z

Link: CVE-2023-41356

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-11-03T07:15:14.403

Modified: 2023-11-14T18:11:34.807

Link: CVE-2023-41356

JSON object: View

Redhat Information

No data.

CWE

CWE-639

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-41356", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-08-29T00:14:47.636Z", "datePublished": "2023-11-03T06:18:37.853Z", "dateUpdated": "2023-11-03T06:18:37.853Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Tronclass ilearn", "vendor": "WisdomGarden", "versions": [{"status": "affected", "version": "V1.4 2021/09/14"}]}], "datePublic": "2023-11-03T06:20:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files."}], "value": "NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files."}], "impacts": [{"capecId": "CAPEC-294", "descriptions": [{"lang": "en", "value": "CAPEC-294 ICMP Address Mask Request"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-11-03T06:18:37.853Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7506-b4e29-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to the latest version."}], "value": "Update to the latest version."}], "source": {"advisory": "TVN-202311012", "discovery": "EXTERNAL"}, "title": "WisdomGarden Tronclass ilearn - Broken Access Control", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wisdomgarden:tronclass_ilearn:1.62.41849:hotfix-v1-62-84ccf1a5:*:*:*:*:*:*", "matchCriteriaId": "C84E10C6-AD71-4352-A193-7032C33249F5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files."}, {"lang": "es", "value": "La funci\u00f3n especial de la aplicaci\u00f3n NCSIST ManageEngine Mobile Device Manager (MDM) tiene una vulnerabilidad de path traversal. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad para omitir la autenticaci\u00f3n y leer archivos arbitrarios del sistema."}], "id": "CVE-2023-41356", "lastModified": "2023-11-14T18:11:34.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2023-11-03T07:15:14.403", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7506-b4e29-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}