8.8

CVE-2023-45687

Exploit

Authentication bypass via session fixation in Titan MFT and Titan SFTP servers

A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Southrivertech ≫ Titan Mft Server SwPlatform linux Version < 2.0.18
Southrivertech ≫ Titan Mft Server SwPlatform windows Version < 2.0.18
Southrivertech ≫ Titan Sftp Server SwPlatform linux Version < 2.0.18
Southrivertech ≫ Titan Sftp Server SwPlatform windows Version < 2.0.18
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.18% 0.635
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
Vendor Advisory
https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/
Third Party Advisory
Exploit