CVE-2023-45228

Description

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.

Reserved 2023-10-25 | Published 2023-10-26 | Updated 2025-01-16 | Assigner icscert

Problem types

CWE-284 Improper Access Control

Product status

Default status
unaffected

2.12 (EXC5000GX)
affected

2.12 (EXC120GX)
affected

2.11 (EXC300GX)
affected

2.10 (EXC1600GX)
affected

2.10 (EXC2000GX)
affected

2.08 (EXC1600GX)
affected

2.08 (EXC1000GX)
affected

2.07 (EXC3000GX)
affected

2.06 (EXC5000GX)
affected

1.7.7 (EXC30GT)
affected

1.7.4 (EXC300GT)
affected

1.7.4 (EXC100GT)
affected

1.7.4 (EXC5000GT)
affected

1.6.3 (EXC1000GT)
affected

1.5.4 (EXC120GT)
affected

Default status
unaffected

2.06 (RTX19)
affected

2.05 (RTX19)
affected

2.00 (EXC19)
affected

1.60 (RTX19)
affected

1.59 (RTX19)
affected

1.55 (EXC19)
affected

References

www.cisa.gov/news-events/ics-advisories/icsa-23-299-08

www.sielco.org/en/contacts

cve.org (CVE-2023-45228)

nvd.nist.gov (CVE-2023-45228)

Download JSON