CVE-2023-26258 Auth bypass in n/a
An attacker can bypass authentication by leaking an AuthUUID token to gain administrator privileges and execute arbitrary tasks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26258?
CVE-2023-26258 is a critical authentication bypass vulnerability in n/a, published on 3 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.
Weakness: CWE-863
Which versions are affected by CVE-2023-26258?
It affects 1 product.
Products include Arcserve Udp.
How do I fix CVE-2023-26258?
No fix has been published for CVE-2023-26258 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-26258 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26258 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2015-4068 Arcserve Unified Data Protection (UDP) Directory Traversal
- CVE-2024-0799 Authentication Bypass via wizardLogin in Arcserve Unified Data Protection
- CVE-2023-41998 Arcserve UDP Unauthenticated RCE
- CVE-2023-41999 Arcserve UDP Management Authentication Bypass
- CVE-2023-42000 Arcserve UDP Agent Unauthenticated Path Traversal File Upload
Sources
Also known as GHSA-wvxg-vj6j-j677.