CERT-In Vulnerability Note
CIVN-2023-0226
Multiple Vulnerabilities in Emagic Data Center Management Suite
Original Issue Date:August 03, 2023
Severity Rating: HIGH
Software Affected
- Emagic Data Center Management Suite v6.0 and prior versions
Overview
Multiple vulnerabilities have been reported in ESDS Emagic Data Center Management Suite which could allow a remote attacker to execute arbitrary code or gain unauthorized access to the targeted system.
Description
1. OS Command Injection Vulnerability
(
CVE-2023-37569
)
This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on targeted system.
2. Insufficient Session Expiration Vulnerability
(
CVE-2023-37570
)
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie.
By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system
Credit
These vulnerabilities are reported by Shubham Pandey (CVE-2023-37569) and Lohitya Pushkar (CVE-2023-37569) of C3i Center, IIT Kanpur as well as Chinamay Joshi (CVE-2023-37569, CVE-2023-37570) of ESDS Software Solution Limited, Maharashtra.
Solution
- Upgrade to Enlight360 Datacenter Management Center Suite with latest version v8.9
Vendor Information
ESDS
https://www.esds.co.in/enlight360
References
ESDS
https://www.esds.co.in/enlight360
CVE Name
CVE-2023-37569
CVE-2023-37570
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|