CVE-2023-4709 TOTVS RM Portal Login.aspx cross site scripting
Remote attackers can execute arbitrary scripts via VIEWSTATE manipulation in TOTVS RM Portal if specific non-default configurations are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-4709?
CVE-2023-4709 is a low-severity cross-site scripting vulnerability in TOTVS RM, published on 1 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. It is possible to mitigate the problem by applying the configuration setting <pages validateRequest="true" [...] viewStateEncryptionMode="Always" />. It is recommended to change the configuration settings. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation."
Which versions are affected by CVE-2023-4709?
It affects 1 product.
Products include Totvs Rm.
How do I fix CVE-2023-4709?
No fix has been published for CVE-2023-4709 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-4709 being exploited?
There is no known exploitation of CVE-2023-4709 in the wild and no public exploit code.
Other vulnerabilities in TOTVS RM
Sources
Also known as GHSA-fff7-753p-rxwc.