CVE-2023-45596

A CWE-425 “Direct Request (Forced Browsing)” vulnerability in the “file_configuration” functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

Weakness

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/127.html
• https://cwe.mitre.org/data/definitions/143.html
• https://cwe.mitre.org/data/definitions/144.html
• https://cwe.mitre.org/data/definitions/668.html
• https://cwe.mitre.org/data/definitions/87.html

References

• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45596
• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45596