CVE-2023-49112 - OpenCVE

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so. This issue affects Kiuwan SAST: <master.1808.p685.q13371

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://r.sec-consult.com/kiuwan
https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log

History

No history.

MITRE

Status: PUBLISHED

Assigner: SEC-VLab

Published: 2024-06-20T12:36:18.575Z

Updated: 2024-08-02T21:46:29.305Z

Reserved: 2023-11-22T11:08:37.654Z

Link: CVE-2023-49112

Vulnrichment

Updated: 2024-08-02T21:46:29.305Z

NVD

Status : Awaiting Analysis

Published: 2024-06-20T13:15:49.480

Modified: 2024-07-03T01:42:26.830

Link: CVE-2023-49112

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49112", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2023-11-22T11:08:37.654Z", "datePublished": "2024-06-20T12:36:18.575Z", "dateUpdated": "2024-08-02T21:46:29.305Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "SAST", "vendor": "Kiuwan", "versions": [{"status": "affected", "version": "<master.1808.p685.q13371", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Constantin Schwarz"}, {"lang": "en", "type": "coordinator", "value": "Johannes Greil"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p></p><p>Kiuwan provides an API endpoint</p><pre><code>/saas/rest/v1/info/application</code></pre>to get information about any \napplication, providing only its name via the \"application\" parameter. This endpoint lacks proper access \ncontrol mechanisms, allowing other authenticated users to read \ninformation about applications, even though they have not been granted \nthe necessary rights to do so.<p></p><p></p><p>This issue affects Kiuwan SAST: <master.1808.p685.q13371</p>"}], "value": "Kiuwan provides an API endpoint\n\n/saas/rest/v1/info/application\n\nto get information about any \napplication, providing only its name via the \"application\" parameter. This endpoint lacks proper access \ncontrol mechanisms, allowing other authenticated users to read \ninformation about applications, even though they have not been granted \nthe necessary rights to do so.\n\n\n\nThis issue affects Kiuwan SAST: <master.1808.p685.q13371"}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-06-20T12:36:18.575Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/kiuwan"}, {"tags": ["release-notes"], "url": "https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor provides a patched version master.1808.p685.q13371 which \nshould be installed immediately. See the changelog from the vendor:</p><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log\">https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log</a></p><ul><li>XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06</li><li>Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15</li><li>Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06</li><li>Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06</li><li>Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 2024-02-06</li></ul><p><br> The following upgrade guide was provided by the vendor:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide\">https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide</a></p><p><br>\n Although initially communicated otherwise during responsible disclosure\n in 2022-2023 (see timeline above), the vendor confirmed in 2024 that \nthe SaaS/cloud version is affected and will also be patched. The patch \ndate was 2024-02-05, version 2.8.2402.3.</p><p>SEC Consult also \nsubmitted further security issues to Kiuwan, such as Docker-related \nconfiguration issues which were also fixed during our responsible \ndisclosure.</p><ul><li>Sensitive Data Stored Insecurely for MySQL</li><li>Sensitive Data displayed for wildfly</li><li>Containers Running as root User</li><li>Containers running in the host network</li><li>Exposure of Internal Services</li></ul><br>"}], "value": "The vendor provides a patched version master.1808.p685.q13371 which \nshould be installed immediately. See the changelog from the vendor:\n\n https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log \n\n * XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06\n * Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15\n * Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06\n * Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06\n * Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 2024-02-06\n\n\n\n The following upgrade guide was provided by the vendor:\n https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide \n\n\n\n Although initially communicated otherwise during responsible disclosure\n in 2022-2023 (see timeline above), the vendor confirmed in 2024 that \nthe SaaS/cloud version is affected and will also be patched. The patch \ndate was 2024-02-05, version 2.8.2402.3.\n\nSEC Consult also \nsubmitted further security issues to Kiuwan, such as Docker-related \nconfiguration issues which were also fixed during our responsible \ndisclosure.\n\n * Sensitive Data Stored Insecurely for MySQL\n * Sensitive Data displayed for wildfly\n * Containers Running as root User\n * Containers running in the host network\n * Exposure of Internal Services"}], "source": {"discovery": "UNKNOWN"}, "title": "Insecure Direct Object Reference in Kiuwan SAST", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "affected": [{"vendor": "kiuwan", "product": "sast", "cpes": ["cpe:2.3:a:kiuwan:sast:master.1808.p685.q13371:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "master.1808.p685.q13371", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-27T19:07:32.893224Z", "id": "CVE-2023-49112", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T19:14:56.847Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:29.305Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://r.sec-consult.com/kiuwan"}, {"tags": ["release-notes", "x_transferred"], "url": "https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://r.sec-consult.com/kiuwan", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log", "tags": ["release-notes", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:29.305Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-49112", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-27T19:07:32.893224Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kiuwan:sast:master.1808.p685.q13371:*:*:*:*:*:*:*"], "vendor": "kiuwan", "product": "sast", "versions": [{"status": "affected", "version": "master.1808.p685.q13371"}], "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T19:09:38.468Z"}}], "cna": {"title": "Insecure Direct Object Reference in Kiuwan SAST", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Constantin Schwarz"}, {"lang": "en", "type": "coordinator", "value": "Johannes Greil"}], "affected": [{"vendor": "Kiuwan", "product": "SAST", "versions": [{"status": "affected", "version": "<master.1808.p685.q13371", "versionType": "custom"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "The vendor provides a patched version master.1808.p685.q13371 which \nshould be installed immediately. See the changelog from the vendor:\n\n https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log \n\n * XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06\n * Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15\n * Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06\n * Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06\n * Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 2024-02-06\n\n\n\n The following upgrade guide was provided by the vendor:\n https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide \n\n\n\n Although initially communicated otherwise during responsible disclosure\n in 2022-2023 (see timeline above), the vendor confirmed in 2024 that \nthe SaaS/cloud version is affected and will also be patched. The patch \ndate was 2024-02-05, version 2.8.2402.3.\n\nSEC Consult also \nsubmitted further security issues to Kiuwan, such as Docker-related \nconfiguration issues which were also fixed during our responsible \ndisclosure.\n\n * Sensitive Data Stored Insecurely for MySQL\n * Sensitive Data displayed for wildfly\n * Containers Running as root User\n * Containers running in the host network\n * Exposure of Internal Services", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor provides a patched version master.1808.p685.q13371 which \nshould be installed immediately. See the changelog from the vendor:</p><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log\">https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log</a></p><ul><li>XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06</li><li>Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15</li><li>Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06</li><li>Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06</li><li>Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 2024-02-06</li></ul><p><br> The following upgrade guide was provided by the vendor:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide\">https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide</a></p><p><br>\n Although initially communicated otherwise during responsible disclosure\n in 2022-2023 (see timeline above), the vendor confirmed in 2024 that \nthe SaaS/cloud version is affected and will also be patched. The patch \ndate was 2024-02-05, version 2.8.2402.3.</p><p>SEC Consult also \nsubmitted further security issues to Kiuwan, such as Docker-related \nconfiguration issues which were also fixed during our responsible \ndisclosure.</p><ul><li>Sensitive Data Stored Insecurely for MySQL</li><li>Sensitive Data displayed for wildfly</li><li>Containers Running as root User</li><li>Containers running in the host network</li><li>Exposure of Internal Services</li></ul><br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/kiuwan", "tags": ["third-party-advisory"]}, {"url": "https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Kiuwan provides an API endpoint\n\n/saas/rest/v1/info/application\n\nto get information about any \napplication, providing only its name via the \"application\" parameter. This endpoint lacks proper access \ncontrol mechanisms, allowing other authenticated users to read \ninformation about applications, even though they have not been granted \nthe necessary rights to do so.\n\n\n\nThis issue affects Kiuwan SAST: <master.1808.p685.q13371", "supportingMedia": [{"type": "text/html", "value": "<p></p><p></p><p>Kiuwan provides an API endpoint</p><pre><code>/saas/rest/v1/info/application</code></pre>to get information about any \napplication, providing only its name via the \"application\" parameter. This endpoint lacks proper access \ncontrol mechanisms, allowing other authenticated users to read \ninformation about applications, even though they have not been granted \nthe necessary rights to do so.<p></p><p></p><p>This issue affects Kiuwan SAST: <master.1808.p685.q13371</p>", "base64": false}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-06-20T12:36:18.575Z"}}}, "cveMetadata": {"cveId": "CVE-2023-49112", "state": "PUBLISHED", "dateUpdated": "2024-08-02T21:46:29.305Z", "dateReserved": "2023-11-22T11:08:37.654Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2024-06-20T12:36:18.575Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.1"}