CVE-2023-29065 Overly Permissive Access Policy
Attackers with physical access can directly access the database to steal credentials and alter or destroy data due to overly permissive access policies.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29065?
CVE-2023-29065 is a medium-severity missing authorization vulnerability in Becton, Dickinson and Company (BD) FACSChorus, published on 28 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.
Which versions are affected by CVE-2023-29065?
It affects 1 product.
Products include Bd Facschorus.
How do I fix CVE-2023-29065?
No fix has been published for CVE-2023-29065 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-29065 being exploited?
There is no known exploitation of CVE-2023-29065 in the wild and no public exploit code.
Other vulnerabilities in Becton, Dickinson and Company (BD) FACSChorus
Sources
Also known as GHSA-3gxr-jgff-j84x.