Lucene search

TwcertCVE-2023-37287

HistoryJul 10, 2023 - 2:15 a.m.

CVE-2023-37287

2023-07-1002:15:45

CWE-798

twcert

web.nvd.nist.gov

smartbpm.net

cve-2023-37287

vulnerability

hard-coded

authentication

remote access

application data

submission

approval

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.

Affected configurations

Nvd

Node

smartsoftsmartbpm.netMatch6.70

VendorProductVersionCPE
smartsoftsmartbpm.net6.70cpe:2.3:a:smartsoft:smartbpm.net:6.70:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
smartsoft	smartbpm.net	6.70	cpe:2.3:a:smartsoft:smartbpm.net:6.70:::::::*

CNA Affected

[
  {
    "vendor": "SamrtSoft",
    "product": "SmartBPM.NET ",
    "versions": [
      {
        "version": "6.70",
        "status": "affected"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7222-cdfd0-1.html

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

Related for CVE-2023-37287