CVE-2023-6344

Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypass

Description

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.

Category

5.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 1.24% Top 25%
Vendor Advisory aquaforest.com Vendor Advisory aquaforest.com
Affected: Tyler Technologies Court Case Management Plus
Published at:
Updated at:

References

Link Tags
https://www.tylertech.com/solutions/courts-public-safety/courts-justice product
https://www.aquaforest.com/blog/tiff-server-security-update vendor advisory
https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsetting product vendor advisory
https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md third party advisory
https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/ media coverage press/media coverage third party advisory
https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systems government resource third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2023-6344?
CVE-2023-6344 has been scored as a medium severity vulnerability.
How to fix CVE-2023-6344?
To fix CVE-2023-6344, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-6344 being actively exploited in the wild?
It is possible that CVE-2023-6344 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-6344?
CVE-2023-6344 affects Tyler Technologies Court Case Management Plus.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.