CVE-2023-36106 PowerJob incorrect access control vulnerability

What is CVE-2023-36106?

CVE-2023-36106 is a high-severity vulnerability in n/a, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.

Weakness: CWE-284

Which versions are affected by CVE-2023-36106?

2 open source packages ship an affected version, including tech.powerjob:powerjob. It affects 1 product.

Products include Powerjob Powerjob.

How do I fix CVE-2023-36106?

No fix has been published for CVE-2023-36106 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-36106 being exploited?

There is no known exploitation of CVE-2023-36106 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-44546 SQL injection in n/a Critical 9.8
• CVE-2023-37754 Code injection in PowerJob Critical 9.8
• CVE-2023-29924 PowerJob vulnerable to incorrect access control Critical 9.8
• CVE-2023-29926 PowerJob vulnerable to remote code execution Critical 9.8
• CVE-2020-28865 Insufficiently Protected Credentials in PowerJob High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-443m-3fr6-w8wj.