CVE-2023-6578
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2023-6578 is a newly discovered critical vulnerability affecting Software AG WebMethods 10.11.x and 10.15.x. The issue lies within an unidentified function in the wm.server/connect/ directory, leading to insufficient access controls. An attacker can exploit this remotely, potentially gaining unauthorized access to sensitive information such as internal IPs, ports, and versions. In some instances, access to certain directories may be denied, but visiting a specific incorrect path, such as /assets/x, followed by revisiting /assets/, may reveal the requested data. The vendor, VDB, was notified early but has yet to respond.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- webMethods
Affected Vendors
- Software AG Group
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions