CVE-2023-42954 Information disclosure in FileMaker Server
An administrator logged into the FileMaker Server Admin Console could expose sensitive information to front-end websites, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42954?
CVE-2023-42954 is a medium-severity vulnerability in Claris FileMaker Server, published on 21 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests.
Weakness: CWE-250
Which versions are affected by CVE-2023-42954?
It affects 2 products.
Products include Claris Claris Pro, Claris Filemaker Server.
How do I fix CVE-2023-42954?
No fix has been published for CVE-2023-42954 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-42954 being exploited?
There is no known exploitation of CVE-2023-42954 in the wild and no public exploit code.
Other vulnerabilities in Claris FileMaker Server
Sources
Also known as GHSA-4qv4-vh73-q92w.