// For flags

CVE-2023-42034

Visualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass Vulnerability

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Visualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Visualware MyConnection Server. Minimal user interaction is required to exploit this vulnerability.

The specific flaw exists within the doRTAAccessCTConfig method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21613.

Vulnerabilidad de omisión de autenticación de Cross-Site Scripting de Visualware MyConnection Server doRTAAccessCTConfig. Esta vulnerabilidad permite a atacantes remotos eludir la autenticación en las instalaciones afectadas de Visualware MyConnection Server. Se requiere una interacción mínima del usuario para aprovechar esta vulnerabilidad. La falla específica existe dentro del método doRTAAccessCTConfig. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede llevar a la inyección de un script arbitrario. Un atacante puede aprovechar esta vulnerabilidad para eludir la autenticación en el sistema. Era ZDI-CAN-21613.

This vulnerability allows remote attackers to bypass authentication on affected installations of Visualware MyConnection Server. Minimal user interaction is required to exploit this vulnerability.
The specific flaw exists within the doRTAAccessCTConfig method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system.

*Credits: 06fe5fd2bc53027c4a3b7e395af0b850e7b8a044
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-09-06 CVE Reserved
  • 2023-09-08 CVE Published
  • 2024-05-03 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Visualware
Search vendor "Visualware"
 MyConnection Server
Search vendor "Visualware" for product "MyConnection Server"
 11.3
Search vendor "Visualware" for product "MyConnection Server" and version "11.3"
en
Affected