CVE-2023-6342

Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 'payforprint_CM/Redirector.ashx?userid=' parameters. The vulnerable "pay for print" feature was removed on or around 2023-11-01.

Score

CVSS 3.1 9.8 Critical

Status

Modified - 9119a7d8-5eab-497f-8521-727c672e3725

Published

2023-11-30

Last modified

2024-10-15

Weaknesses

CWE-287

Affected products

• Court Case Management Plus (Tyler Technologies)
• Court Case Management Plus (Tylertech)

References

• https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md
• https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/
• https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document…
• https://www.tylertech.com/solutions/courts-public-safety/courts-justice