CVE-2023-45687

Published: Oct 16, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing

Affected (4)

Products: Southrivertech: Titan Mft Server, Titan Sftp Server

2 products

Titan Mft Server

Titan Sftp Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Southrivertech Titan Mft Server	Before 2.0.18
Southrivertech Titan Mft Server	Before 2.0.18

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Southrivertech Titan Sftp Server	Before 2.0.18
Southrivertech Titan Sftp Server	Before 2.0.18

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (4)

https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690

Source: cve@rapid7.com

Vendor Advisory

https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Source: cve@rapid7.com

ExploitThird Party Advisory

https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.