CVE-2023-45596 Information disclosure in imx6 bundle

Medium 5.3 Published 5 Mar 2024 Updated 17 Oct 2024

Remote unauthenticated attackers can access confidential configuration files via forced browsing in the AiLux imx6 bundle web application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-45596?

CVE-2023-45596 is a medium-severity vulnerability in AiLux imx6 bundle, published on 5 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

Weakness: CWE-425

Which versions are affected by CVE-2023-45596?

It affects 1 product.

Products include Ailux Imx6.

How do I fix CVE-2023-45596?

No fix has been published for CVE-2023-45596 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-45596 being exploited?

There is no known exploitation of CVE-2023-45596 in the wild and no public exploit code.

Sources

Also known as GHSA-4pg2-jrch-m6p4.