Medium severity · published May 26, 2023
CVE-2023-32311
CloudExplorer Lite is an open source cloud management platform
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not properly checked. This allows users to add themselves to any organization. This vulnerability has been fixed in v1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cloudexplorer · Fit2cloud
before 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32311
Vendor Advisory
https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-hxjq-g9qv-pwq5
More from Cloudexplorer
4.3
CVE-2023-32316
CloudExplorer Lite is an open source cloud management tool