Atos Unify OpenScape Common Management Portal V10 up to 4.16.x/5.0.x Common Management Portal Web Interface path traversal

Summaryinfo

A vulnerability has been found in Atos Unify OpenScape Common Management Portal V10 up to 4.16.x/5.0.x and classified as critical. The impacted element is an unknown function of the component Common Management Portal Web Interface. Performing a manipulation results in path traversal. This vulnerability is known as CVE-2023-45352. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Atos Unify OpenScape Common Management Portal V10 up to 4.16.x/5.0.x. This affects an unknown part of the component Common Management Portal Web Interface. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system via a Common Management Portal web interface Path traversal vulnerability allowing write access outside the intended folders. This is also known as OCMP-6592.

The weakness was published 10/09/2023. The advisory is shared at networks.unify.com. This vulnerability is uniquely identified as CVE-2023-45352 since 10/09/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 4.17.0 or 5.1.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-49645). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Atos Unify

Name

• OpenScape Common Management Portal V10

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 5.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion