CVE-2023-41263

Severity Score

3.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP addresses and source types, an unauthenticated attacker can download debug logs containing application-related information.

Se descubrió un problema en Plixer Scrutinizer antes de la versión 19.3.1. Expone registros de depuración a usuarios no autenticados en la ruta URL /debug/. Con conocimiento de las direcciones IP válidas y los tipos de fuentes, un atacante no autenticado puede descargar registros de depuración que contengan información relacionada con la aplicación.

*Credits: N/A

CVSS Scores

NISTv3.1 3.7

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-08-25 CVE Reserved
2023-10-12 CVE Published
2024-09-18 CVE Updated
2024-09-18 First Exploit
2024-11-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-532: Insertion of Sensitive Information into Log File

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.md	2024-09-18

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Plixer Search vendor "Plixer"		Scrutinizer Search vendor "Plixer" for product "Scrutinizer"				< 19.3.1 Search vendor "Plixer" for product "Scrutinizer" and version " < 19.3.1"		-		Affected