{"id":"CVE-2023-6483","state":"PUBLISHED","title":"Improper Authentication Vulnerability in ADiTaaS","description":"The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS backend API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable platform.\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain full access to the customers’ data and completely compromise the targeted platform.\n","publishedAt":"2023-12-18T08:04:54.658Z","updatedAt":"2025-05-07T20:38:23.422Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"CERT-In"},"assigner":"CERT-In","products":["ADiTaaS Allied Digital Integrated Tool-as-a-Service"],"affected":[{"vendor":"ADiTaaS","product":"Allied Digital Integrated Tool-as-a-Service","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.1 ","versionType":"custom"}]}],"references":["https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0365"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6483.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-6483","state":"PUBLISHED","datePublished":"2023-12-18T08:04:54.658Z","dateUpdated":"2025-05-07T20:38:23.422Z","assignerShortName":"CERT-In","assignerOrgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateReserved":"2023-12-04T10:23:22.916Z"},"containers":{"cna":{"title":"Improper Authentication Vulnerability in ADiTaaS ","descriptions":[{"lang":"en","value":"The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS backend API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable platform.\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain full access to the customers’ data and completely compromise the targeted platform.\n"}],"affected":[{"vendor":"ADiTaaS","product":"Allied Digital Integrated Tool-as-a-Service","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.1 ","versionType":"custom"}]}],"references":[{"url":"https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0365"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-In","orgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateUpdated":"2023-12-18T08:04:54.658Z"},"credits":[{"lang":"en","type":"finder","value":"This vulnerability is reported by Eaton Zveare. "}],"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to ADiTaaS version 5.1.1 or later."}],"value":"Upgrade to ADiTaaS version 5.1.1 or later."}],"source":{"discovery":"UNKNOWN"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0365","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:28:21.823Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-07T20:38:13.816099Z","id":"CVE-2023-6483","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-07T20:38:23.422Z"}}]}}}