Lucene search

K
nvd9119a7d8-5eab-497f-8521-727c672e3725NVD:CVE-2023-6343
HistoryNov 30, 2023 - 6:15 p.m.

CVE-2023-6343

2023-11-3018:15:08
CWE-287
9119a7d8-5eab-497f-8521-727c672e3725
web.nvd.nist.gov
tyler technologies
court case management plus
remote attacker
unauthenticated
enumerate
access sensitive files
aquaforest tiff server
deprecated
2.x
removed
2023-11-01
insecure configuration
cve-2023-6352
cve-2020-9323

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

60.9%

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx ‘FN’ and ‘PN’ parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.

Affected configurations

NVD
Node
tylertechcourt_case_management_plusMatch-

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

60.9%

Related for NVD:CVE-2023-6343