CVE-2023-44397 CloudExplorer Lite permission bypass vulnerability
Attackers can bypass permission checks in CloudExplorer Lite by exploiting a gateway filter path matching flaw, gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-44397?
CVE-2023-44397 is a high-severity authentication bypass vulnerability in CloudExplorer-Dev CloudExplorer-Lite, published on 30 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue.
Weakness: CWE-287
Which versions are affected by CVE-2023-44397?
It affects 1 product.
Products include Fit2cloud Cloudexplorer Lite.
How do I fix CVE-2023-44397?
No fix has been published for CVE-2023-44397 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-44397 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-44397 exists.
Other vulnerabilities in CloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-38692 Command injection vulnerability in module management function in CloudExplorer Lite
- CVE-2023-2845 Improper Access Control in cloudexplorer-dev/cloudexplorer-lite
- CVE-2023-50612 Privilege escalation in n/a
- CVE-2023-42147 Information disclosure in n/a
- CVE-2023-39519 CloudExplorer Lite sensitive information leakage vulnerability
Sources
Also known as GHSA-fqxr-7g94-vrfj.