CVE-2023-32311 The CloudExplorer Lite missing permissions check
Attackers can add themselves to any organization due to missing permission checks, requiring an upgrade to CloudExplorer Lite.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32311?
CVE-2023-32311 is a high-severity missing authorization vulnerability in CloudExplorer-Dev CloudExplorer-Lite, published on 26 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not properly checked. This allows users to add themselves to any organization. This vulnerability has been fixed in v1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-862
Which versions are affected by CVE-2023-32311?
It affects 1 product.
Products include Fit2cloud Cloudexplorer.
How do I fix CVE-2023-32311?
No fix has been published for CVE-2023-32311 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-32311 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32311 exists.
Other vulnerabilities in CloudExplorer-Dev CloudExplorer-Lite
Sources
Also known as GHSA-hxjq-g9qv-pwq5.