Havelsan Inc
Monthly
HAVELSAN Liman MYS releases from 2.3.4-1124 up to but not including 2.3.5-1131 contain a weak forgotten-password recovery mechanism (CWE-640) that lets a network attacker abuse the account-recovery workflow to take over a targeted account, with high confidentiality and integrity impact and no effect on availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1) indicates the flaw is network-reachable and low complexity and needs no attacker credentials, but it is not fully autonomous because a victim must perform some recovery-related action (UI:R); the exact weakness in the recovery flow is not described in the available sources. No CISA KEV entry and no exploit code reference were provided, so no public exploit identified at time of analysis; TR-CERT rates it for remediation within this week.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
Improper certificate validation (CWE-295) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 lets an attacker sitting on the network path between client and server impersonate the server in an Adversary-in-the-Middle attack. The flaw is not remotely reachable by a passive attacker: it only becomes exploitable once the adversary already holds an on-path position (untrusted Wi-Fi, shared network, compromised gateway or malicious transit infrastructure), which is why CVSS rates it AC:H despite PR:N and UI:N. Successful interception yields high confidentiality and integrity impact - chat content, credentials and session material traversing the TLS channel can be read or manipulated - with no availability impact; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), giving an assessed score of 7.4.
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.
Privilege escalation and unauthorized functionality access in HAVELSAN Liman MYS (Yönetim Sistemi) before release.Master.1107 allows an authenticated low-privileged user to invoke functions that should be gated by access-control lists. Because certain endpoints fail to enforce authorization (CWE-862), a limited user can reach administrative or restricted operations, enabling significant integrity and availability impact. No public exploit identified at time of analysis; the flaw was reported by Turkey's national CERT (TR-CERT / USOM).
Path traversal in HAVELSAN Liman MYS before 2.3.5-1132 allows an authenticated low-privilege user to read files outside the intended directory over the network, with high confidentiality impact and no integrity or availability impact. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and versions at or above 2.3.5-1132 are not affected. No CISA KEV active-exploitation signal or public exploit code was provided at time of analysis, and EPSS data was not supplied; the issue was reported by TR-CERT.
Missing authorization (CWE-862) in HAVELSAN's Sef - AI Chatbot Platform allows an authenticated, low-privileged user to reach functionality that is not properly constrained by access control lists, resulting in unauthorized access to data (confidentiality impact only, no integrity or availability effect). The vulnerability affects all versions before 2.1 and carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires valid credentials and additional non-trivial conditions - the high attack complexity reflects the need for specific request state, timing, or knowledge of protected object identifiers rather than a single trivial request. There is no public exploit code and no confirmed active exploitation at time of analysis; the issue was reported by TR-CERT and is documented in the Turkish national CERT advisory TR-26-1241.
Server-side request forgery (SSRF) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 allows an authenticated attacker with high privileges (PR:H) to cause the server to make requests to arbitrary URLs, potentially reading internal resources reachable from the server. This moderate-severity flaw (CVSS 4.9) is network-reachable without user interaction, but requires a privileged session, limiting exploitation to trusted or compromised elevated accounts. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper TLS certificate validation in HAVELSAN Liman Render Engine (versions from 1.0 up to but not including 1.2-75) lets a network-positioned adversary conduct an adversary-in-the-middle attack, causing the engine to accept forged or otherwise invalid certificates so that intercepted traffic can be decrypted and sensitive data disclosed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows no authentication or user-interaction prerequisite, but exploitation hinges on the attacker first occupying a man-in-the-middle position on the path between an engine endpoint and its peer, which is why the attack is scored high-complexity and the impact is confidentiality-only with no integrity or availability effect. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with automatable 'no' and partial technical impact, and the issue was reported by TR-CERT.
Interception of the key exchange in HAVELSAN Liman Render Engine (versions 1.0 up to but not including 1.2-75) allows an on-path attacker to decrypt or meddle with traffic, because keys are agreed without authenticating the peer entity (CWE-322). Exploitation requires the attacker to already hold a position on the network path between the victim client and the Render Engine - through ARP spoofing, a rogue access point, or a compromised router - which is why the issue carries HIGH attack complexity even though no credentials (PR:N) and no user interaction (UI:N) are needed. The impact is confined to confidentiality (CVSS 3.1 base 5.9, C:H/I:N/A:N); no public exploit code and no active exploitation have been identified at time of analysis, and the CISA SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate, situational risk rather than a broad-exploitation priority.
A path traversal flaw (CWE-22) in HAVELSAN Liman MYS versions 2.3.2 up to but not including 2.3.4-1124 allows remote, unauthenticated attackers to read files outside the intended web-accessible directory, resulting in limited confidentiality exposure. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3), no credentials, privileges, or user interaction are required, so any reachable instance of an affected version is directly exposed to attempts; the impact is confined to partial file disclosure with no write, integrity, or availability effect. No public exploit code was identified at the time of analysis and there is no CISA KEV listing, so exploitation is not confirmed to be active, but the low attack complexity and lack of authentication make the issue practically attractive against internet-exposed Liman MYS deployments. This is a genuine but modest-priority issue.
HAVELSAN Liman MYS releases from 2.3.4-1124 up to but not including 2.3.5-1131 contain a weak forgotten-password recovery mechanism (CWE-640) that lets a network attacker abuse the account-recovery workflow to take over a targeted account, with high confidentiality and integrity impact and no effect on availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1) indicates the flaw is network-reachable and low complexity and needs no attacker credentials, but it is not fully autonomous because a victim must perform some recovery-related action (UI:R); the exact weakness in the recovery flow is not described in the available sources. No CISA KEV entry and no exploit code reference were provided, so no public exploit identified at time of analysis; TR-CERT rates it for remediation within this week.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
Improper certificate validation (CWE-295) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 lets an attacker sitting on the network path between client and server impersonate the server in an Adversary-in-the-Middle attack. The flaw is not remotely reachable by a passive attacker: it only becomes exploitable once the adversary already holds an on-path position (untrusted Wi-Fi, shared network, compromised gateway or malicious transit infrastructure), which is why CVSS rates it AC:H despite PR:N and UI:N. Successful interception yields high confidentiality and integrity impact - chat content, credentials and session material traversing the TLS channel can be read or manipulated - with no availability impact; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), giving an assessed score of 7.4.
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.
Privilege escalation and unauthorized functionality access in HAVELSAN Liman MYS (Yönetim Sistemi) before release.Master.1107 allows an authenticated low-privileged user to invoke functions that should be gated by access-control lists. Because certain endpoints fail to enforce authorization (CWE-862), a limited user can reach administrative or restricted operations, enabling significant integrity and availability impact. No public exploit identified at time of analysis; the flaw was reported by Turkey's national CERT (TR-CERT / USOM).
Path traversal in HAVELSAN Liman MYS before 2.3.5-1132 allows an authenticated low-privilege user to read files outside the intended directory over the network, with high confidentiality impact and no integrity or availability impact. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and versions at or above 2.3.5-1132 are not affected. No CISA KEV active-exploitation signal or public exploit code was provided at time of analysis, and EPSS data was not supplied; the issue was reported by TR-CERT.
Missing authorization (CWE-862) in HAVELSAN's Sef - AI Chatbot Platform allows an authenticated, low-privileged user to reach functionality that is not properly constrained by access control lists, resulting in unauthorized access to data (confidentiality impact only, no integrity or availability effect). The vulnerability affects all versions before 2.1 and carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires valid credentials and additional non-trivial conditions - the high attack complexity reflects the need for specific request state, timing, or knowledge of protected object identifiers rather than a single trivial request. There is no public exploit code and no confirmed active exploitation at time of analysis; the issue was reported by TR-CERT and is documented in the Turkish national CERT advisory TR-26-1241.
Server-side request forgery (SSRF) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 allows an authenticated attacker with high privileges (PR:H) to cause the server to make requests to arbitrary URLs, potentially reading internal resources reachable from the server. This moderate-severity flaw (CVSS 4.9) is network-reachable without user interaction, but requires a privileged session, limiting exploitation to trusted or compromised elevated accounts. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper TLS certificate validation in HAVELSAN Liman Render Engine (versions from 1.0 up to but not including 1.2-75) lets a network-positioned adversary conduct an adversary-in-the-middle attack, causing the engine to accept forged or otherwise invalid certificates so that intercepted traffic can be decrypted and sensitive data disclosed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows no authentication or user-interaction prerequisite, but exploitation hinges on the attacker first occupying a man-in-the-middle position on the path between an engine endpoint and its peer, which is why the attack is scored high-complexity and the impact is confidentiality-only with no integrity or availability effect. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with automatable 'no' and partial technical impact, and the issue was reported by TR-CERT.
Interception of the key exchange in HAVELSAN Liman Render Engine (versions 1.0 up to but not including 1.2-75) allows an on-path attacker to decrypt or meddle with traffic, because keys are agreed without authenticating the peer entity (CWE-322). Exploitation requires the attacker to already hold a position on the network path between the victim client and the Render Engine - through ARP spoofing, a rogue access point, or a compromised router - which is why the issue carries HIGH attack complexity even though no credentials (PR:N) and no user interaction (UI:N) are needed. The impact is confined to confidentiality (CVSS 3.1 base 5.9, C:H/I:N/A:N); no public exploit code and no active exploitation have been identified at time of analysis, and the CISA SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate, situational risk rather than a broad-exploitation priority.
A path traversal flaw (CWE-22) in HAVELSAN Liman MYS versions 2.3.2 up to but not including 2.3.4-1124 allows remote, unauthenticated attackers to read files outside the intended web-accessible directory, resulting in limited confidentiality exposure. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3), no credentials, privileges, or user interaction are required, so any reachable instance of an affected version is directly exposed to attempts; the impact is confined to partial file disclosure with no write, integrity, or availability effect. No public exploit code was identified at the time of analysis and there is no CISA KEV listing, so exploitation is not confirmed to be active, but the low attack complexity and lack of authentication make the issue practically attractive against internet-exposed Liman MYS deployments. This is a genuine but modest-priority issue.