PT-2023-20006 · Stimulsoft · Stimulsoft Designer+1

Bsc + 4 · Publicado 2023-03-27 · Atualizado 2023-04-03 · CVE-2023-25263

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stimulsoft Designer (Desktop) versions 2023.1.4 through 2023.1.5

Description The issue allows an attacker to decrypt connection strings stored in .mrt files by decompiling the Stimulsoft.report.dll, as it uses a static secret that does not differ between versions or operating systems.

Recommendations For versions 2023.1.4 and 2023.1.5, consider restricting access to the Stimulsoft.report.dll file to prevent decompilation until a patch is available. As a temporary workaround, avoid storing sensitive connection strings in .mrt files for these versions.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-25263

Produtos afetados

Stimulsoft Designer

Stimulsoft.Report.Dll

Referências · 5

• 🔥 https://cves.at/posts/cve-2023-25263/writeup · Exploit
• https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa · Nota
• http://stimulsoft.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25263 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25263 · Aviso do Fabricante