Vulnerability · Published May 26, 2023 · Assigned by GitHub_M

CVE-2023-32311The CloudExplorer Lite missing permissions check

High 7.1

In plain English

A high-severity missing authorization in CloudExplorer-Lite from CloudExplorer-Dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 67.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not properly checked. This allows users to add themselves to any organization. This vulnerability has been fixed in v1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
CloudExplorer-Dev	CloudExplorer-Lite	< 1.1.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-hxjq-g9qv-pwq5 x_refsource_CONFIRM