CVE-2023-6522 - Vulnerability Details - OpenCVE

Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Extremepacs	Extreme Xds

No data.

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-24-0276

History

Thu, 26 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 26 Sep 2024 12:15:00 +0000

Type	Values Removed	Values Added
Description	Improper Privilege Management vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.	Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.

Mon, 26 Aug 2024 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-269

Mon, 26 Aug 2024 15:00:00 +0000

Type	Values Removed	Values Added
Description	Improper Privilege Management vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.	Improper Privilege Management vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.
Weaknesses		CWE-648

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2024-04-05T11:33:30.000Z

Updated: 2024-09-26T12:11:09.133Z

Reserved: 2023-12-05T13:04:46.474Z

Link: CVE-2023-6522

Vulnrichment

Updated: 2024-08-02T08:35:14.741Z

NVD

Status : Awaiting Analysis

Published: 2024-04-05T12:15:36.267

Modified: 2024-11-21T08:44:01.433

Link: CVE-2023-6522

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6522", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2023-12-05T13:04:46.474Z", "datePublished": "2024-04-05T11:33:30.000Z", "dateUpdated": "2024-09-26T12:11:09.133Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Extreme XDS", "vendor": "ExtremePacs", "versions": [{"lessThan": "3914", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mustafa An\u0131l YILDIRIM"}], "datePublic": "2024-04-05T11:33:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.<p>This issue affects Extreme XDS: before 3914.</p>"}], "value": "Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914."}], "impacts": [{"capecId": "CAPEC-569", "descriptions": [{"lang": "en", "value": "CAPEC-569 Collect Data as Provided by Users"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-648", "description": "CWE-648 Incorrect Use of Privileged APIs", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-26T12:11:09.133Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0276"}], "source": {"advisory": "TR-24-0276", "defect": ["TR-24-0276"], "discovery": "UNKNOWN"}, "title": "Information Disclosure in ExtremePacs's Extreme XDS", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T15:51:05.560769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:17:18.966Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:35:14.741Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0276", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0276", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:35:14.741Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T15:51:05.560769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.193Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Information Disclosure in ExtremePacs's Extreme XDS", "source": {"defect": ["TR-24-0276"], "advisory": "TR-24-0276", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mustafa An\u0131l YILDIRIM"}], "impacts": [{"capecId": "CAPEC-569", "descriptions": [{"lang": "en", "value": "CAPEC-569 Collect Data as Provided by Users"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ExtremePacs", "product": "Extreme XDS", "versions": [{"status": "affected", "version": "0", "lessThan": "3914", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2024-04-05T11:33:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-0276"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.<p>This issue affects Extreme XDS: before 3914.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-648", "description": "CWE-648 Incorrect Use of Privileged APIs"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-26T12:11:09.133Z"}}}, "cveMetadata": {"cveId": "CVE-2023-6522", "state": "PUBLISHED", "dateUpdated": "2024-09-26T12:11:09.133Z", "dateReserved": "2023-12-05T13:04:46.474Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2024-04-05T11:33:30.000Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}