Medium severity · published May 26, 2023
CVE-2023-32316
CloudExplorer Lite is an open source cloud management tool
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is due to a missing permission check on the user profile. It is recommended to upgrade the version to v1.1.0. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cloudexplorer · Fit2cloud
before 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32316
Vendor Advisory
https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-cp3j-437h-4vwj
More from Cloudexplorer
4.3
CVE-2023-32311
CloudExplorer Lite is an open source cloud management platform