BE-2024-0001: ALIM Web Token Exposure
Bentley ID: BE-2024-0001
CVE ID: CVE-2024-27455
Severity: 9.3
CVSS v3.1: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Publication date: 2024-02-19
Revision date: 2024-02-19
Summary
The ALIM Web application may be affected by an issue where certain configuration settings can cause exposure of users ALIM session token when users attempt to download files.
Details
The exposed token may be used in a manner that allows users access to files within ALIM which they do not have permissions to.
影響を受けるバージョン
| 用途 | 影響を受けるバージョン | 軽減されているバージョン |
| Assetwise ALIM Web | >=23.00.04.04 | |
| Assetwise Information Integrity Server | >=23.00.02.03 |
Recommended Mitigations
Upgrade to latest versions of ALIM Web (23.00.02.03 or later) and Assetwise Information Integrity Server (23.00.04.04 or later). Existing installs hosted by Bentley have already been mitigated. Where upgrade isn’t possible please reach out to Bentley Support for secure configuration instructions.
謝辞
改訂履歴
| 日付 | 製品名 |
| 2024-02-19 | この勧告の初版 |
| 2024-03-08 | Amend to ALIM Web Version affected |
| 2024-03-25 | Amend to versions affected |
