Lucene search

MitreCVE-2023-36649

HistoryDec 12, 2023 - 1:15 a.m.

CVE-2023-36649

2023-12-1201:15:10

CWE-532

mitre

web.nvd.nist.gov

information security

cve-2023-36649

grafana

prolion cryptospike

remote attackers

impersonation

jwt tokens

loki rest api

authentication

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

46.6%

JSON

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs (as a Granafa authenticated user) or from the Loki REST API without authentication.

Affected configurations

Nvd

Node

prolioncryptospikeMatch3.0.15p2

VendorProductVersionCPE
prolioncryptospike3.0.15cpe:2.3:a:prolion:cryptospike:3.0.15:p2:*:*:*:*:*:*

Vendor	Product	Version	CPE
prolion	cryptospike	3.0.15	cpe:2.3:a:prolion:cryptospike:3.0.15:p2::::::

References

www.cvcn.gov.it/cvcn/cve/CVE-2023-36649

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

46.6%

JSON

Related for CVE-2023-36649