Lucene search

[email protected]CVE-2023-22897

HistoryApr 12, 2023 - 11:15 p.m.

CVE-2023-22897

2023-04-1223:15:07

CWE-908

[email protected]

web.nvd.nist.gov

securepoint utm

vulnerability

information disclosure

cve-2023-22897

memory contents

authenticated users

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.032 Low

EPSS

Percentile

91.2%

JSON

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall’s endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.

CPENameOperatorVersion
securepoint:unified_threat_managementsecurepoint unified threat managementlt12.2.5.1
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.3.2
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.5
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.4.1
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.3.3
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.3.4
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.4
securepoint:unified_threat_managementsecurepoint unified threat managementeq12.2.3.1

CPE	Name	Operator	Version
securepoint:unified_threat_management	securepoint unified threat management	lt	12.2.5.1
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.3.2
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.5
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.4.1
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.3.3
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.3.4
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.4
securepoint:unified_threat_management	securepoint unified threat management	eq	12.2.3.1

References

packetstormsecurity.com/files/171928/SecurePoint-UTM-12.x-Memory-Leak.html

seclists.org/fulldisclosure/2023/Apr/8

github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txt

rcesecurity.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.032 Low

EPSS

Percentile

91.2%

JSON

Related for CVE-2023-22897

prion1 zdt1 packetstorm1 cvelist1 nuclei1