by Kastro
Paper/Archive/CVE-2023-51644

CVE-2023-51644

Allegra Allegra — Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.5.805 × 2016.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Struts. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22512.

Affected

ProductAffectedFixed inSource
Allegra7.5.0 build 29–CNA
allegra7.5.0build29–CISA-ADP

Scores by source

zdi (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refzerodayinitiative.com/advisories/ZDI-24-102advisorytrackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html