ExploitCVE-2023-3643
External Control of File Name or Path (CWE-73)
Published: Jul 12, 2023 / Updated: 16mo ago
010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard
A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
First Article
Feedly found the first article mentioning CVE-2023-3643. See article
Jul 12, 2023 at 4:28 PM / vuldb.com
Affected Systems
Carel/boss_mini_firmware
+null more
Exploits
https://drive.google.com/file/d/1RXmDUAjqZvWSvHUrfRerz7My6M3KX7YG/view
+null more
Links to Mitre Att&cks
T1562.003: Impair Command History Logging
+null more
Attack Patterns
CAPEC-13: Subverting Environment Variable Values
+null more
News
Snowflake Breach Snowballs With More Victims
We know the list of Snowflake victims is long – at least 165 targets were caught up in the security failure, threat hunters at Mandiant reported recently – including, it’s believed after news broke this week, Australian ticketing provider Ticketek. US car part retailer Advance Auto Parts was also believed to be a Snowflake victim, which the company confirmed last week in a filing with the US Securities and Exchange Commission.
Snowflake breach snowballs as more victims, perps, come forward
We know the list of Snowflake victims is long – at least 165 targets were caught up in the security failure, threat hunters at Mandiant reported recently – including, it’s believed after news broke this week, Australian ticketing provider Ticketek. US car part retailer Advance Auto Parts was also believed to be a Snowflake victim, which the company confirmed last week in a filing with the US Securities and Exchange Commission.
Snowflake breach snowballs as more victims, perps, come forward - The Register
We know the list of Snowflake victims is long – at least 165 targets were caught up in the security failure, threat hunters at Mandiant reported recently – including, it's believed after news broke this week, Australian ticketing provider Ticketek. US car part retailer Advance Auto Parts was also believed to be a Snowflake victim, which the company confirmed last week in a filing with the US Securities and Exchange Commission.
CAREL Boss-Mini
Successful exploitation of this vulnerability could allow an attacker to manipulate an argument path, which would lead to information disclosure. The following versions of CAREL Boss-Mini, a local supervisor solution, are affected:
CAREL Boss-Mini
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Ensure the device has been deployed in a segregated internal network as per CAREL's security recommendations ( doc code +030220471 available at carel.com ).
See 12 more articles and social media posts