CVE-2023-2665: Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
RosarioSIS prior to 11.0 allows anyone, regardless of authentication status, to download and view file attachments under the salaries module. In addition, the file names contain a date in a YYYY-MM-DD format and a random six-string digit, making enumerating file names with automated tools relatively easy. This could allow an attacker to gain access to sensitive salary information. The patch for version 11.0 adds microseconds to filenames to make them harder to guess.
Other sources
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2665?
CVE-2023-2665 is a vulnerability in RosarioSIS that allows anyone to download and view file attachments under the 'salaries' module without authentication.
How does CVE-2023-2665 affect RosarioSIS?
CVE-2023-2665 affects RosarioSIS version 11.0, allowing unauthorized users to access sensitive data.
What is the severity of CVE-2023-2665?
CVE-2023-2665 has a severity rating of 7.5 (high).
How can I fix CVE-2023-2665?
To fix CVE-2023-2665, update RosarioSIS to a version higher than 11.0 or apply the appropriate security patches.
Where can I find more information about CVE-2023-2665?
You can find more information about CVE-2023-2665 in the references provided: https://github.com/francoisjacquet/rosariosis/commit/09d5afaa6be07688ca1a7ac3b755b5438109e986, https://huntr.dev/bounties/42f38a84-8954-484d-b5ff-706ca0918194, https://nvd.nist.gov/vuln/detail/CVE-2023-2665