TI-2023-05820 Aliases CVE-2023-6341 GHSA-v85w-cvcx-r2qh

Catalis CM360 allows authentication bypass

LOW 26CWE-639Published 2023-11-30 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Catalis (previously Icon Software) CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation.

Why it matters now

EPSS 0.00862 58th percentileScored 2026-11-07

Fix Fixed CMS360 (Catalis): ~2023-11-03

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Catalis	CMS360	before ~2023-11-03	~2023-11-03	Patch available	CNA

CMS360 VendorCatalis Affected before ~2023-11-03 Fixed in ~2023-11-03 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:catalisgov:cms360:-:::::::*	not specified by NVD	Vulnerable	Catalisgov

cpe:2.3:a:catalisgov:cms360:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Catalisgov

Remediation

Fix · CNA CMS360 (Catalis) Fixed in ~2023-11-03

Timeline

2026-10-02 Threatist record created from CVE-2023-6341
2026-10-03 Alias added: GHSA-v85w-cvcx-r2qh

References

Advisory 3

Other 1

https://catalisgov.com/courts-land-records-support/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences