7.5

CVE-2023-30223

Exploit
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
4d ≫ Server Version 17
4d ≫ Server Version 18 Update -
4d ≫ Server Version 18 Update r5
4d ≫ Server Version 19 Update -
4d ≫ Server Version 19 Update r7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.12% 0.62
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://packetstormsecurity.com
Third Party Advisory
VDB Entry
Not Applicable
https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure/
https://www.infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server/
Exploit