Tutti gli avvisi / BE-2024-0001

BE-2024-0001

BE-2024-0001: ALIM Web Token Exposure

Bentley ID: BE-2024-0001
CVE ID: CVE-2024-27455
Severity: 9.3
CVSS v3.1: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Publication date: 2024-02-19
Revision date: 2024-02-19

Summary
The ALIM Web application may be affected by an issue where certain configuration settings can cause exposure of users ALIM session token when users attempt to download files.

Details
The exposed token may be used in a manner that allows users access to files within ALIM which they do not have permissions to.

Affected Versions

Applications Affected Versions Mitigated Versions
Assetwise ALIM Web >=23.00.04.04
Assetwise Information Integrity Server >=23.00.02.03

 

Recommended Mitigations
Upgrade to latest versions of ALIM Web (23.00.02.03 or later) and Assetwise Information Integrity Server (23.00.04.04 or later). Existing installs hosted by Bentley have already been mitigated. Where upgrade isn’t possible please reach out to Bentley Support for secure configuration instructions.

Acknowledgement

Revision History

Date Descrizione
19-02-2024 Prima versione dell'avviso
08-03-2024 Amend to ALIM Web Version affected
25-03-2024 Amend to versions affected

20% di sconto sui software di Bentley

L'offerta termina venerdì

Usa il codice coupon "THANKS24"

Celebra la realizzazione di infrastrutture e l’eccellenza delle prestazioni

Year in Infrastructure e Going Digital Awards 2024

Candida un progetto per i premi più prestigiosi nel settore delle infrastrutture! La scadenza prorogata per partecipare è il 29 aprile.