PT-2023-1633 · Unknown · Mxsecurity

Esj4Y · Publicado 2023-03-08 · Atualizado 2023-06-02 · CVE-2023-33236

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MXsecurity version 1.0

Description The issue is related to hardcoded credentials in MXsecurity, which can be exploited to craft arbitrary JWT tokens and bypass authentication for web-based APIs. This allows a remote attacker to elevate their privileges.

Recommendations For MXsecurity version 1.0, consider disabling the use of hardcoded credentials and JWT token generation until a patch is available. Restrict access to web-based APIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2023-01149

CVE-2023-33236

ZDI-23-720

Produtos afetados

Mxsecurity

Referências · 9

• https://t.me/cibsecurity/64512 · Publicação no Telegram
• https://moxa.com/en/support/product-support/security-advisory/mxsecurity-command-injection-and-hardcoded-credential-vulnerabilities · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-23-720 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01149 · Nota de Segurança
• https://t.me/cvenotify/50896 · Publicação no Telegram
• https://t.me/cvenotify/50899 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33236 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33236 · Aviso do Fabricante
• https://t.me/true_secator/4456 · Publicação no Telegram