Cyber Resilience

CVE-2023-6353

Medium

Published: 30 November 2023

Published
30 November 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0158 82.0th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-6353 is a medium-severity Improper Authentication (CWE-287) vulnerability in Tylertech Court Case Management Plus. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked in the top 18.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.

CWE(s)
CWE-287

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
Why these techniques?

Unauthenticated parameter manipulation enables arbitrary file upload (T1105 Ingress Tool Transfer), deletion (T1070.004 File Deletion), exploitation of public-facing web app (T1190), and collection of sensitive court records from the filing repository (T1213).

Affected Assets

tylertech
court case management plus
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification
addresses: CWE-287

Detects unauthorized successful logons resulting from improper authentication implementations.

AT-1 Policy and Procedures
addresses: CWE-287

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

AT-2 Literacy Training and Awareness
addresses: CWE-287

Security awareness training instructs users on secure authentication practices and avoiding credential compromise.

AT-3 Role-based Training
addresses: CWE-287

Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.

AU-10 Non-repudiation
addresses: CWE-287

Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.

AU-14 Session Audit
addresses: CWE-287

Session content review can reveal authentication bypasses or failures in session establishment.

AU-6 Audit Record Review, Analysis, and Reporting
addresses: CWE-287

Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.

CA-2 Control Assessments
addresses: CWE-287

Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.

References