Vulnerability · Published Nov 30, 2023 · Assigned by cisa-cg
CVE-2023-6353Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass
Medium 5.3
In plain English
A medium-severity improper authentication in Civil and Criminal Electronic Filing from Tyler Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.0%top 37.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tyler Technologies | Civil and Criminal Electronic Filing | 0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.tylertech.com/solutions/courts-public-safety/courts-justice product
- https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md
- https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/ media-coverage
- https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems third-party-advisory, government-resource