Lucene search

Cisa-cgCVE-2023-6344

HistoryNov 30, 2023 - 6:15 p.m.

CVE-2023-6344

2023-11-3018:15:08

CWE-287

cisa-cg

web.nvd.nist.gov

cve-2023-6344

tyler technologies

court case management plus

remote attack

directory enumeration

aquaforest tiff server

deprecated

vulnerability

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx ‘ifolder’ parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.

Affected configurations

Nvd

Node

tylertechcourt_case_management_plusMatch-

VendorProductVersionCPE
tylertechcourt_case_management_plus-cpe:2.3:a:tylertech:court_case_management_plus:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tylertech	court_case_management_plus	-	cpe:2.3:a:tylertech:court_case_management_plus:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Court Case Management Plus",
    "vendor": "Tyler Technologies",
    "versions": [
      {
        "lessThan": "~2023-11-01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md

techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/

www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting

www.aquaforest.com/blog/tiff-server-security-update

www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems

www.tylertech.com/solutions/courts-public-safety/courts-justice

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Related for CVE-2023-6344