Vulnerability · Published Nov 30, 2023 · Assigned by cisa-cg
CVE-2023-6343Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypass
Medium 5.3
In plain English
A medium-severity improper authentication in Court Case Management Plus from Tyler Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'FN' and 'PN' parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tyler Technologies | Court Case Management Plus | 0 – before ~2023-11-01 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.tylertech.com/solutions/courts-public-safety/courts-justice product
- https://www.aquaforest.com/blog/tiff-server-security-update vendor-advisory
- https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting product
- https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md
- https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/ media-coverage
- https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems third-party-advisory, government-resource