Paper/Archive/CVE-2023-6353

CVE-2023-6353

Tyler Technologies Civil and Criminal Electronic Filing — Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass

EPSS 1.0%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (NVD)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 62.5.625 × 2012.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.

Affected

ProductAffectedFixed inSource

Civil and Criminal Electronic Filingall versions–CNA

Scores by source

NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

cisa-cg (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reftylertech.com/solutions/courts-public-safety/courts-justice refgithub.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md reftechcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents writeupcisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems