CVE-2023-6190 - OpenCVE

Improper Input Validation vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ikcu	University Information Management System

Configuration 1 [-]

cpe:2.3:a:ikcu:university_information_management_system:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-23-0736

History

Tue, 27 Aug 2024 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Tue, 27 Aug 2024 09:00:00 +0000

Type	Values Removed	Values Added
Description	Improper Input Validation vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023.	Improper Input Validation vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023.

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2023-12-27T14:36:35.559Z

Updated: 2024-09-09T17:59:38.443Z

Reserved: 2023-11-17T13:20:50.540Z

Link: CVE-2023-6190

Vulnrichment

Updated: 2024-08-02T08:21:17.928Z

NVD

Status : Modified

Published: 2023-12-27T15:15:45.900

Modified: 2024-08-27T09:15:03.540

Link: CVE-2023-6190

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6190", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2023-11-17T13:20:50.540Z", "datePublished": "2023-12-27T14:36:35.559Z", "dateUpdated": "2024-09-09T17:59:38.443Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "University Information Management System", "vendor": "\u0130zmir Katip \u00c7elebi University", "versions": [{"lessThan": "30.11.2023", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Mustafa An\u0131l YILDIRIM"}], "datePublic": "2023-12-27T14:40:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Input Validation vulnerability in \u0130zmir Katip \u00c7elebi University University Information Management System allows Absolute Path Traversal.<p>This issue affects University Information Management System: before 30.11.2023.</p>"}], "value": "Improper Input Validation vulnerability in \u0130zmir Katip \u00c7elebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023."}], "impacts": [{"capecId": "CAPEC-597", "descriptions": [{"lang": "en", "value": "CAPEC-597 Absolute Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-08-27T08:43:51.498Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-23-0736"}], "source": {"advisory": "TR-23-0736", "defect": ["TR-23-0736"], "discovery": "UNKNOWN"}, "title": "Authenicated Path Traversal in \u0130zmir Katip \u00c7elebi University", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:21:17.928Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-23-0736", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-09T17:59:23.689893Z", "id": "CVE-2023-6190", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T17:59:38.443Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-23-0736", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:21:17.928Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-09T17:59:23.689893Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T17:59:30.989Z"}}], "cna": {"title": "Authenicated Path Traversal in \u0130zmir Katip \u00c7elebi University", "source": {"defect": ["TR-23-0736"], "advisory": "TR-23-0736", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Mustafa An\u0131l YILDIRIM"}], "impacts": [{"capecId": "CAPEC-597", "descriptions": [{"lang": "en", "value": "CAPEC-597 Absolute Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "\u0130zmir Katip \u00c7elebi University", "product": "University Information Management System", "versions": [{"status": "affected", "version": "0", "lessThan": "30.11.2023", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2023-12-27T14:40:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-23-0736"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in \u0130zmir Katip \u00c7elebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023.", "supportingMedia": [{"type": "text/html", "value": "Improper Input Validation vulnerability in \u0130zmir Katip \u00c7elebi University University Information Management System allows Absolute Path Traversal.<p>This issue affects University Information Management System: before 30.11.2023.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-08-27T08:43:51.498Z"}}}, "cveMetadata": {"cveId": "CVE-2023-6190", "state": "PUBLISHED", "dateUpdated": "2024-09-09T17:59:38.443Z", "dateReserved": "2023-11-17T13:20:50.540Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2023-12-27T14:36:35.559Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ikcu:university_information_management_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB9D24F2-B97F-4FEA-828C-E20D8036D5E5", "versionEndExcluding": "30.11.2023", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in \u0130zmir Katip \u00c7elebi University University Information Management System allows Absolute Path Traversal.This issue affects University Information Management System: before 30.11.2023."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada incorrecta en ?zmir Katip \u00c7elebi University University Information Management System permite un path traversal. Este problema afecta a University Information Management System: antes del 30.11.2023."}], "id": "CVE-2023-6190", "lastModified": "2024-08-27T09:15:03.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}, "published": "2023-12-27T15:15:45.900", "references": [{"source": "iletisim@usom.gov.tr", "tags": ["Third Party Advisory"], "url": "https://www.usom.gov.tr/bildirim/tr-23-0736"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "iletisim@usom.gov.tr", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Secondary"}]}