CVE-2023-34965 : SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can le

SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information.

Published 2023-06-13 19:15:10

Updated 2023-06-23 18:14:58

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-34965

Sspanel-uim Project » Sspanel-uim » Version: 2023.3
cpe:2.3:a:sspanel-uim_project:sspanel-uim:2023.3:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Assigned by: nvd@nist.gov (Primary)

https://docs.google.com/document/d/1TbHYGW65o1HBZoDf0rUDQMHPJE6qfQAvqdFv1DYY4BU/edit?usp=sharing

The SSPanel-Uim /link/ interface does not limit the request rate, which can lead to brute force guessing of the information on the /link/ interface - Google Docs
Exploit;Third Party Advisory
https://github.com/AgentY0/CVE-2023-34965

GitHub - AgentY0/CVE-2023-34965: SSPanel UIM is a multi-purpose agency service sales management system specially designed for Shadowsocks / V2Ray / Trojan protocols. SSPanel-Uim version before 2023.3
Third Party Advisory
https://github.com/Anankke/SSPanel-Uim

GitHub - Anankke/SSPanel-Uim: SSPanel V3 魔改再次修改版
Product

Jump to