CVE-2023-45210 Missing authorization in Pleasanter
Remote authenticated attackers can view temporary files uploaded by other users due to improper access control in Pleasanter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45210?
CVE-2023-45210 is a medium-severity missing authorization vulnerability in Implem Inc. Pleasanter, published on 6 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.
Weakness: CWE-284
Which versions are affected by CVE-2023-45210?
It affects 1 product.
Products include Pleasanter Pleasanter.
How do I fix CVE-2023-45210?
No fix has been published for CVE-2023-45210 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-45210 being exploited?
There is no known exploitation of CVE-2023-45210 in the wild and no public exploit code.
Other vulnerabilities in Implem Inc. Pleasanter
- CVE-2023-32608 Path traversal in Pleasanter (Community Edition and Enterprise Edition)
- CVE-2024-21584 Cross-site scripting in Pleasanter
- CVE-2023-46688 Open redirect in Pleasanter
- CVE-2023-34439 Cross-site scripting in Pleasanter
- CVE-2023-32607 Cross-site scripting in Pleasanter (Community Edition and Enterprise Edition)
Sources
Also known as GHSA-wj8f-78wg-52vw.