漏洞描述
An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2023-22897↗github.comhttps://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txt↗www.rcesecurity.comhttps://www.rcesecurity.com/2023/04/securepwn-part-2-leaking-remote-memory-contents-cve-2023-22897/↗rcesecurity.comhttps://rcesecurity.com↗github.comhttps://github.com/MrTuxracer/advisories↗