Is CVE-2023-51837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-51837 being exploited in the wild.

How severe is CVE-2023-51837?

Low severity, with a CVSS score of 3.1, published 30 January 2024.

Which products and versions are affected?

Ylianst MeshCentral up to 1.1.16.

Is there a fix for CVE-2023-51837?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-51837 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2023-51837?

Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-51837: Ylianst MeshCentral missing SSL certificate validation

CVE-2023-51837 · Severity: low · CVSS 3.1 · Published 2024-01-30

MeshCentral is a web-based remote monitoring and management platform that allows administrators to deploy agents and manage devices across networks. This vulnerability fails to properly validate SSL certificates during connections, allowing attackers to intercept and manipulate encrypted communications with managed devices and systems without detection. An attacker on the network can intercept sensitive management traffic and potentially gain unauthorized access to monitored systems.

Technologies: Ylianst MeshCentral. Vendors: Ylianst.

Quick answers

Is CVE-2023-51837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-51837 being exploited in the wild.
How severe is CVE-2023-51837?: Low severity, with a CVSS score of 3.1, published 30 January 2024.
Which products and versions are affected?: Ylianst MeshCentral up to 1.1.16.
Is there a fix for CVE-2023-51837?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-51837 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2023-51837?: Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-295) is a missing SSL certificate validation flaw in MeshCentral version 1.1.16 and earlier, where the application fails to properly verify SSL/TLS certificates when establishing encrypted connections. The vulnerable code is in mpsserver.js and affects certificate validation logic across the platform. An attacker with network access can perform man-in-the-middle (MITM) attacks without authentication or user interaction to intercept, modify, or inject malicious content into management communications. This allows complete compromise of the remote management channel—attackers can gain full control over monitored devices or extract sensitive data. Patches addressing this validation flaw are available in newer versions.

Affected products

Ylianst MeshCentral up to 1.1.16

Identifiers

CVE-2023-51837
GHSA-8xw6-9h78-c89j

Timeline

2024-01-30: disclosed: GHSA-8xw6-9h78-c89j published
2023: other: CVE-2023-51837 assigned

References

https://github.com/Ylianst/MeshCentral

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.