Which products and versions are affected by CVE-2023-31465?

Affected: Timekeeper (Fsmlabs). The full list is in the CVE brief.

Is CVE-2023-31465 being exploited in the wild?

It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Nov 15, 2023.

Is CVE-2023-31465 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2023-31465?

A public exploit is reported by tracking sources, but no code link is listed yet.

Is there a fix for CVE-2023-31465?

Fixed versions are available, including Timekeeper <=8.0.28, Timekeeper 8.0.28.

How urgently should CVE-2023-31465 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

WatchlistCritical

CVE-2023-31465Timekeeper Vulnerability

Q: What is CVE-2023-31465?

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28.

Q: How urgently should CVE-2023-31465 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call.

Published Jul 26, 2023 · Updated Nov 21, 2024

Key Facts

Patch immediately

CVE-2023-31465 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Timekeeper (Fsmlabs).
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Nov 15, 2023. A public exploit is reported by tracking sources, but no code link is listed yet.
EPSS estimates a 46% probability of exploitation in the next 30 days.
Fixed versions are available, including Timekeeper <=8.0.28, Timekeeper 8.0.28.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Scores

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

46%

Higher than 98.8% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

40/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Nov 15, 2023

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Description

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CIRCL KEV	Nov 15, 2023	n/a	Not reported
Industry KEV feed	Nov 15, 2023	n/a	Not reported

Affected Products

1 affected entries in total

Product	Affected versions	Fixed in
TimekeeperFsmlabs	See advisory	8.0.28

Patched Releases

Timekeeper

<=8.0.28

Timeline

Publicly disclosed
Jul 26, 2023
Added to CIRCL KEV
Nov 15, 2023
Added to Industry KEV feed
Nov 15, 2023
Last updated
Nov 21, 2024

References

6 more references in the full CVE brief

FAQ

Common Questions.

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28.
Affected: Timekeeper (Fsmlabs). The full list is in the CVE brief.
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Nov 15, 2023.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Timekeeper <=8.0.28, Timekeeper 8.0.28.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2023-31465 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo