CVE-2023-6343

Medium

Description

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'FN' and 'PN' parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.

SeverityMedium

CVSS5.3

Exploit probability—

ProductTylertech Court Case Management Plus

PublishedNov 30, 2023

First seenNov 30, 2023

Weakness typeCWE-287Improper authentication

How to fix

Vendor advisories

aquaforest.com/blog/tiff-server-security-update

Affected products

Product	Affected versions	Fixed in
tylertech court_case_management_plus	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.