Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2023-29921
CVE-2023-29921:
Java vulnerability analysis and mitigation
Overview
PowerJob V4.3.1 contains an Incorrect Access Control vulnerability in the create app interface. The vulnerability was assigned CVE-2023-29921 and was disclosed on April 19, 2023. The vulnerability affects PowerJob version 4.3.1 and allows unauthorized access to application creation functionality (NVD).
Technical details
The vulnerability exists in the /appInfo/save interface where unauthorized users can create applications without proper authentication. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The weakness is classified as CWE-284 (Improper Access Control) (NVD).
Impact
An unauthenticated attacker can create applications by sending a specially crafted POST request to the /appInfo/save endpoint with application name and password parameters. After creating the application, the attacker can then log into the backend using these credentials, potentially gaining unauthorized access to the system (GitHub Issue).
Additional resources
Source: This report was generated using AI
Related Java vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management