CVE-2023-45598 Missing authorization in imx6 bundle

Medium 5.3 Published 5 Mar 2024 Updated 17 Oct 2024

Remote unauthenticated attackers can access confidential measure information via forced browsing in the AiLux imx6 bundle web application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-45598?

CVE-2023-45598 is a medium-severity missing authorization vulnerability in AiLux imx6 bundle, published on 5 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to access confidential measure information. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

Weakness: CWE-425

Which versions are affected by CVE-2023-45598?

It affects 1 product.

Products include Ailux Imx6.

How do I fix CVE-2023-45598?

No fix has been published for CVE-2023-45598 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-45598 being exploited?

There is no known exploitation of CVE-2023-45598 in the wild and no public exploit code.

Sources

Also known as GHSA-m7p8-hcw4-p377.