Paper/Archive/CVE-2023-6354

CVE-2023-6354

Tyler Technologies Magistrate Court Case Management Plus — Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypass

EPSS 1.0%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (NVD)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 62.5.625 × 2012.5 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.

Affected

ProductAffectedFixed inSource

Magistrate Court Case Management Plusall versions–CNA

Scores by source

NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

cisa-cg (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

reftylertech.com/solutions/courts-public-safety/courts-justice refgithub.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md reftechcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents writeupcisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems