From 0db12a3c5e43fb1c75fdea16c7b5669ea4e6d976 Mon Sep 17 00:00:00 2001 From: dzonerzy Date: Mon, 27 Nov 2023 18:00:08 +0100 Subject: [PATCH] mod advisory --- res/advisory/CVE-2023-46453.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/res/advisory/CVE-2023-46453.txt b/res/advisory/CVE-2023-46453.txt index 4b9d7cf..c21f875 100644 --- a/res/advisory/CVE-2023-46453.txt +++ b/res/advisory/CVE-2023-46453.txt @@ -5,6 +5,7 @@ GLiNet: Router Authentication Bypass ======================================================================== Contents ======================================================================== + 1. Overview 2. Detailed Description 3. Exploit @@ -13,6 +14,7 @@ Contents ======================================================================== 1. Overview ======================================================================== + CVE-2023-46453 is a remote authentication bypass vulnerability in the web interface of GLiNet routers running firmware versions 4.x and up. The vulnerability allows an attacker to bypass authentication and gain access @@ -21,6 +23,7 @@ to the router's web interface. ======================================================================== 2. Detailed Description ======================================================================== + The vulnerability is caused by a lack of proper authentication checks in /usr/sbin/gl-ngx-session file. The file is responsible for authenticating users to the web interface. The authentication is in different stages.