cnvd - cnvd-2023-68222

cnvd-2023-68222

Vulnerability from cnvd

Title: ASUSTOR Data Master授权问题漏洞

Description:

ASUSTOR Data Master是中国华硕（ASUS）公司的专属于ASUSTOR NAS上的操作系统。

ASUSTOR Data Master存在授权问题漏洞，该漏洞源于存在不当权限管理，无权限的本地攻击者可利用该漏洞修改存储设备配置。

Severity: 中

Formal description:

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://bramdoessecurity.com/travianz-hacked/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3699

Impacted products

Name
ASUSTOR Data Master >=4.0.6.ris1，<4.2.3.rk91

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-3699",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-3699"
    }
  },
  "description": "ASUSTOR Data Master\u662f\u4e2d\u56fd\u534e\u7855\uff08ASUS\uff09\u516c\u53f8\u7684\u4e13\u5c5e\u4e8eASUSTOR NAS\u4e0a\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nASUSTOR Data Master\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b58\u5728\u4e0d\u5f53\u6743\u9650\u7ba1\u7406\uff0c\u65e0\u6743\u9650\u7684\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4fee\u6539\u5b58\u50a8\u8bbe\u5907\u914d\u7f6e\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://bramdoessecurity.com/travianz-hacked/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-68222",
  "openTime": "2023-08-31",
  "products": {
    "product": "ASUSTOR Data Master \u003e=4.0.6.ris1\uff0c\u003c4.2.3.rk91"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-3699",
  "serverity": "\u4e2d",
  "submitTime": "2023-08-30",
  "title": "ASUSTOR Data Master\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2023-3699 (GCVE-0-2023-3699)

Vulnerability from cvelistv5

Published

2023-08-22 08:57

Modified

2024-10-02 20:09

Severity ?

8.7 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CWE

CWE-269 - Improper Privilege Management

Summary

An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

References

▼	URL	Tags
	https://www.asustor.com/security/security_advisory_detail?id=29	vendor-advisory

Impacted products

	Vendor	Product	Version
	ASUSTOR	ADM	Version: 4.0 < Version: 4.1 < Version: 4.2 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:57.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.asustor.com/security/security_advisory_detail?id=29"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T20:08:25.950632Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-02T20:09:53.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Linux",
            "x86",
            "ARM",
            "64 bit"
          ],
          "product": "ADM",
          "vendor": "ASUSTOR",
          "versions": [
            {
              "lessThanOrEqual": "4.0.6.RIS1",
              "status": "affected",
              "version": "4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.1.0.RLQ1",
              "status": "affected",
              "version": "4.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.2.RI61",
              "status": "affected",
              "version": "4.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "St\u00e9phane Chauveau (stephane@chauveau-central.net)"
        }
      ],
      "datePublic": "2023-08-30T07:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.\u003cbr\u003e"
            }
          ],
          "value": "An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-22T08:57:21.718Z",
        "orgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77",
        "shortName": "ASUSTOR1"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.asustor.com/security/security_advisory_detail?id=29"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "An Improper Privilege Management vulnerability was found on the ADM",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77",
    "assignerShortName": "ASUSTOR1",
    "cveId": "CVE-2023-3699",
    "datePublished": "2023-08-22T08:57:21.718Z",
    "dateReserved": "2023-07-17T06:12:32.684Z",
    "dateUpdated": "2024-10-02T20:09:53.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted