CVE-2023-0882
Assigner: TR-CERT
Published: 2023-02-17T06:44:51.711Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Windows
product: Single Connect
vendor: Kron Tech
versions: status: affected
version: 2.16
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Furkan KAYAPINAR
datePublic: 2023-02-17T07:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse.&nbsp;<span style="background-color: var(--wht);">This issue affects Single Connect: 2.16.</span>
value: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
impacts: capecId: CAPEC-122
descriptions: value: CAPEC-122 Privilege Abuse
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Apply the patch on&nbsp;<a target="_blank" rel="nofollow" href="https://filerepo.krontech.com/index.php/s/VQRlYxpzsECp3UU">https://filerepo.krontech.com/index.php/s/VQRlYxpzsECp3UU</a>&nbsp;

<span style="background-color: rgb(255, 255, 255);">(md5sum: 6fea2b58915854b663f43fdf4516522a, instructions on <a target="_blank" rel="nofollow" href="https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability">https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability</a><a target="_blank" rel="nofollow" href="https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability">)</a>

)</span>&nbsp; and update the Single Connect (PAM) to version 2.16.1.
value: Apply the patch on  https://filerepo.krontech.com/index.php/s/VQRlYxpzsECp3UU https://filerepo.krontech.com/index.php/s/VQRlYxpzsECp3UU  

(md5sum: 6fea2b58915854b663f43fdf4516522a, instructions on  https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability  ) https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability 

)  and update the Single Connect (PAM) to version 2.16.1.
source: advisory: TR-23-0092
defect: TR-23-0092
discovery: EXTERNAL
timeline: time: 2023-02-14T12:00:00.000Z
value: Vendor informed about the vulnerability.
time: 2023-02-16T18:00:00.000Z
value: Patch published by the vendor
title: Authorization Bypass Through User-Controlled Key on Single Connect
x_generator: engine: Vulnogram 0.1.0-dev