spectrum vulnerabilities and fixes

Recent CVEs affecting spectrum, with upgrade or downgrade steps. 8 tracked.

spectrum has 8 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 8. Most recent: 2024-09-10. Highest priority: CVE-2023-37227 (score 52/100).

• CVE-2023-37234 CRITICAL 9.8 UPGRADE Loftware Spectrum through 4.6 has unprotected JMX Registry.
• CVE-2023-37233 HIGH 8.8 UPGRADE Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.
• CVE-2023-37232 HIGH 7.5 UPGRADE Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor.
• CVE-2023-37231 CRITICAL 9.8 UPGRADE Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.
• CVE-2023-37230 HIGH 8.8 UPGRADE Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.
• CVE-2023-37229 HIGH 8.8 UPGRADE Loftware Spectrum before 5.1 allows SSRF.
• CVE-2023-37227 CRITICAL 9.8 UPGRADE Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
• CVE-2023-37226 CRITICAL 9.8 UPGRADE Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.

FAQ

How do I fix spectrum vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is spectrum being exploited right now?

None of the tracked spectrum CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which spectrum CVE should I patch first?

CVE-2023-37227 currently ranks highest (52/100): Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data..

RSS feed for spectrum · ← Back to latest CVEs