CVE-2023-45687

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
South River Technologies	Titan MFT	<= 2.0.17.2298
South River Technologies	Titan SFTP	<= 2.0.17.2298
southrivertech	titan_mft_server	< 2.0.18
southrivertech	titan_mft_server	< 2.0.18
southrivertech	titan_sftp_server	< 2.0.18
southrivertech	titan_sftp_server	< 2.0.18

References

https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690Vendor Advisory
https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/Exploit, Third Party Advisory
https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690Vendor Advisory
https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/Exploit, Third Party Advisory

Timeline

Published: Oct 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-456884.3Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker t CVE-2023-456896.5Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticate CVE-2023-45695.5A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local at CVE-2023-456904.9Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the O CVE-2023-456967.5Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data CVE-2023-456986.1Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in or CVE-2023-45708.8An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services expose CVE-2023-457005.4HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leadi CVE-2023-457016.5HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2023-457025.5An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by lo CVE-2023-457037.5HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.CVE-2023-457057.2An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.