CVE-2023-39481— Softing Secure Integration Server 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2023-39481の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability
ソース: CVE Program / CVE List V5
脆弱性説明
Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the web server. The issue results from an inconsistency in URI parsing between NGINX and application code. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20551.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
解释冲突
ソース: CVE Program / CVE List V5
脆弱性タイトル
Softing Secure Integration Server 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Softing Secure Integration Server是德国Softing公司的一款安全集成服务器。提供强大的 OPC UA 数据集成层并支持接口抽象、聚合、数据预处理和安全监督。 Softing Secure Integration Server 存在安全漏洞，该漏洞源于 Web 服务器中存在特定缺陷，NGINX 和应用程序代码之间的 URI 解析不一致，攻击者利用该漏洞可以在 root 上下文中执行任意代码。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Softing | Secure Integration Server | 1.22.0.8686 | - |
II. CVE-2023-39481の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2023-39481のインテリジェンス情報
请登录查看更多情报信息。
CVE-2023-39481 厂商安全公告 (1)
- ZDI-23-1063 | Zero Day Initiativex_research-advisory
Same Patch Batch · Softing · 2024-05-03 · 9 CVEs total
| CVE-2023-39480 | Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vuln | |
| CVE-2023-39482 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulne | |
| CVE-2023-39479 | Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability | |
| CVE-2023-39478 | Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Executi | |
| CVE-2023-38125 | Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code E | |
| CVE-2023-27334 | Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulne | |
| CVE-2023-27336 | Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vul | |
| CVE-2023-27335 | Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability |
IV. 関連脆弱性
- CVE-2023-39482
Softing Secure Integration Server Hardcoded Cryptographic Ke - CVE-2023-39480
Softing Secure Integration Server FileDirectory OPC UA Objec - CVE-2023-39478
Softing Secure Integration Server Exposure of Resource to Wr - CVE-2023-39479
Softing Secure Integration Server OPC UA Gateway Directory C - CVE-2022-2337
Softing Secure Integration Server NULL Pointer Dereference
同じベンダー: Softing
- CVE-2023-7339
Data collection for dowloading leads into buffer overflow - CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or - CVE-2025-13406
Scanning for higher HART revision device leads into NULL poi - CVE-2025-10461
Global file reads caused by improper URL checks in webserver - CVE-2025-10685
HTTP POST with specific higher content length leads into hea
同じ弱点: CWE-436
- CVE-2026-73615
Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via - CVE-2026-73614
Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncati - CVE-2026-49473
@cedar-policy/authorization-for-expressjs has an authorizati - CVE-2026-18246
IBM i is Affected By security restrictions bypass in Navigat - CVE-2026-68968
Apache Airflow: Authorization bypass in the Backfill API thr
V. CVE-2023-39481へのコメント
まだコメントはありません