Vulnerability · Published Nov 30, 2023 · Assigned by cisa-cg
CVE-2023-6344Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypass
Medium 5.3
In plain English
A medium-severity improper authentication in Court Case Management Plus from Tyler Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tyler Technologies | Court Case Management Plus | 0 – before ~2023-11-01 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.tylertech.com/solutions/courts-public-safety/courts-justice product
- https://www.aquaforest.com/blog/tiff-server-security-update vendor-advisory
- https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting product
- https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md
- https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/ media-coverage
- https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems third-party-advisory, government-resource