CVE-2023-48375

SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:csharp:cws_collaborative_development_platform:10.25:*:*:*:*:*:*:*

History

21 Nov 2024, 08:31

Type	Values Removed	Values Added
References	~~() https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html - Third Party Advisory~~	() https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html - Third Party Advisory

20 Dec 2023, 13:45

Type	Values Removed	Values Added
First Time		Csharp Csharp cws Collaborative Development Platform
CPE		cpe:2.3:a:csharp:cws_collaborative_development_platform:10.25:::::::*
CWE		CWE-862
References	~~() https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html -~~	() https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html - Third Party Advisory

15 Dec 2023, 13:42

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-15 08:15

Updated : 2024-11-21 08:31

NVD link : CVE-2023-48375

Mitre link : CVE-2023-48375

CVE.ORG link : CVE-2023-48375

JSON object : View

Products Affected

csharp

cws_collaborative_development_platform

CWE

CWE-862

Missing Authorization

{"id": "CVE-2023-48375", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-12-15T08:15:45.000", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service."}, {"lang": "es", "value": "SmartStar Software CWS es una plataforma de integraci\u00f3n basada en web, tiene la vulnerabilidad de falta de autorizaci\u00f3n y los usuarios pueden acceder a datos o realizar acciones que no se les deber\u00eda permitir realizar mediante comandos. Un usuario autenticado con privilegios normales puede ejecutar privilegios de administrador, lo que resulta en la realizaci\u00f3n de operaciones arbitrarias del sistema o la interrupci\u00f3n del servicio."}], "lastModified": "2024-11-21T08:31:35.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:csharp:cws_collaborative_development_platform:10.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10CC0021-D5D9-4794-9ABE-DF8F1B21F6A2"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}