CVE-2023-4310 Vulnerability Details

  /     /     /  

CVE-2023-4310 Metadata Quick Info

CVE Published: 05/09/2023 | CVE Updated: 01/10/2024 | CVE Year: 2023
Source: cisa-cg | Vendor: BeyondTrust | Product: Privileged Remote Access (PRA)
Status : PUBLISHED

---

CVE-2023-4310 Description

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute underlying operating system commands within the context of the site user. This issue is fixed in version 23.2.3.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-77
CWE Name: CWE-77 Improper Neutralization of Special Elements used in a Command ( Command Injection )
Source: BeyondTrust

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).