CVE-2023-29923
published 2023-04-19CVE-2023-29923: PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
PriorityP342medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
9.54%
94.9th percentile
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| powerjob | powerjob | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Unauthenticated POST to /job/list with JSON body containing appId, index, and pageSize fields; a successful response contains '{"success":true,"data":{"index":0,"pageSize":10,' in the body with Content-Type application/json header and HTTP 200 status. ↗
- →Shodan fingerprinting query for exposed PowerJob instances: http.html:"powerjob" ↗
- →FOFA fingerprinting queries for exposed PowerJob instances: app="PowerJob", app="powerjob", body="powerjob" ↗
- ·The vulnerability affects PowerJob versions up to and including 4.3.2; the unauthenticated /job/list endpoint requires no authentication token or session cookie, making any POST to this path from an unauthenticated source suspicious. ↗
- ·The appId value of 1 is used in the PoC payload; real-world exploitation may enumerate other appId values to access additional job listings. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PowerJob vulnerable to Insecure Permissions
ghsa·2023-04-19
CVE-2023-29923 [MEDIUM] CWE-276 PowerJob vulnerable to Insecure Permissions
PowerJob vulnerable to Insecure Permissions
PowerJob V4.3.1 is vulnerable to Insecure Permissions via the list job interface.
OSV
PowerJob vulnerable to Insecure Permissions
osv·2023-04-19
CVE-2023-29923 [MEDIUM] PowerJob vulnerable to Insecure Permissions
PowerJob vulnerable to Insecure Permissions
PowerJob V4.3.1 is vulnerable to Insecure Permissions via the list job interface.
No detection rules found.
Nuclei
PowerJob <=4.3.2 - Unauthenticated Access
nuclei·CVSS 5.3
CVE-2023-29923 [MEDIUM] PowerJob <=4.3.2 - Unauthenticated Access
PowerJob <=4.3.2 - Unauthenticated Access
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
Template:
id: CVE-2023-29923
info:
name: PowerJob <=4.3.2 - Unauthenticated Access
author: For3stCo1d
severity: medium
description: |
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
impact: |
An attacker can exploit this vulnerability to gain unauthorized access to sensitive information or perform malicious actions.
remediation: |
Upgrade PowerJob to a version higher than 4.3.2 or apply the necessary patches to fix the authentication bypass issue.
reference:
- https://github.com/PowerJob/PowerJob/issues/587
- https://nvd.nist.gov/vuln/detail/CVE-2023-29923
- https://github.com/KayCHENvip/vulnerability-poc
- https://github.com/Le
Nuclei
PowerJob V4.3.1 - Authentication Bypass
nuclei·CVSS 5.3
CVE-2023-29922 [MEDIUM] PowerJob V4.3.1 - Authentication Bypass
PowerJob V4.3.1 - Authentication Bypass
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
Template:
id: CVE-2023-29922
info:
name: PowerJob V4.3.1 - Authentication Bypass
author: Co5mos
severity: medium
description: |
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
impact: |
Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the application.
remediation: |
Apply the latest security patch or upgrade to a patched version of PowerJob V4.3.1.
reference:
- https://github.com/PowerJob/PowerJob/issues/585
- https://nvd.nist.gov/vuln/detail/CVE-2023-29922
- https://github.com/CN016/Powerjob-CVE-2023-29922-
- https://github.com/nom
No writeups or analysis indexed.
2023-04-19
Published