Lucene search

9119a7d8-5eab-497f-8521-727c672e3725CVE-2023-6343

HistoryNov 30, 2023 - 6:15 p.m.

CVE-2023-6343

2023-11-3018:15:08

CWE-287

9119a7d8-5eab-497f-8521-727c672e3725

web.nvd.nist.gov

cve-2023-6343

tyler technologies

court case management plus

remote file access

aquaforest tiff server

security vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx ‘FN’ and ‘PN’ parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.

Affected configurations

NVD

Node

tylertechcourt_case_management_plusMatch-

VendorProductVersionCPE
tylertechcourt_case_management_plus-cpe:/a:tylertech:court_case_management_plus:-:::

Vendor	Product	Version	CPE
tylertech	court_case_management_plus	-	cpe:/a:tylertech:court_case_management_plus:-:::

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Court Case Management Plus",
    "vendor": "Tyler Technologies",
    "versions": [
      {
        "lessThan": "~2023-11-01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md

techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/

www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting

www.aquaforest.com/blog/tiff-server-security-update

www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems

www.tylertech.com/solutions/courts-public-safety/courts-justice

Social References

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Related for CVE-2023-6343