CVE-2023-48929 Auth bypass in n/a
Attackers can exploit session fixation in System Sentinel AnyWare to escalate privileges and access sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48929?
CVE-2023-48929 is a critical authentication bypass vulnerability in n/a, published on 8 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resource allows an attacker to escalate privileges and obtain sensitive information.
Weakness: CWE-384
Which versions are affected by CVE-2023-48929?
It affects 1 product.
Products include Franklin-Electric System Sentinel Anyware.
How do I fix CVE-2023-48929?
No fix has been published for CVE-2023-48929 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-48929 being exploited?
There is no known exploitation of CVE-2023-48929 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3q3r-9fqq-hxcm.