Unauthenticated file access via filename manipulation
Published Nov 30, 2023 · Updated Aug 2, 2024
Improper authentication in Tyler Technologies Magistrate Court Case Management Plus allows remote attackers to access files without signing in. PDFViewer.aspx trusts the attacker-controlled filename parameter for file operations without enforcing authorization, enabling arbitrary uploads, deletions, and reads. The endpoint is network reachable and needs no account or user interaction; successful use exposes restricted court documents and permits file modification or removal.
Summary
What happened
Improper authentication in Tyler Technologies Magistrate Court Case Management Plus allows remote attackers to access files without signing in. PDFViewer.aspx trusts the attacker-controlled filename parameter for file operations without enforcing authorization, enabling arbitrary uploads, deletions, and reads. The endpoint is network reachable and needs no account or user interaction; successful use exposes restricted court documents and permits file modification or removal.
The record
- CVE
- CVE-2023-6354
- Published
- Nov 30, 2023
- Updated
- Aug 2, 2024
- Vendor
- Tyler Technologies
- Product
- Magistrate Court Case Management Plus
- Classifications
- CWE-287, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Nov 30, 2023CVE publishedPublication date reported by the CVE source.
- Aug 2, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- PDFViewer.aspx filename-parameter disclosureproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo