PT-2023-20479 · European Chemicals Agency · Iuclid

CVE-2023-26089 · Publicado 2023-05-02 · Atualizado 2025-01-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions European Chemicals Agency IUCLID versions 5.15.0 through 6.27.5

Description The issue allows authentication bypass due to a weak hard-coded secret used for JWT signing.

Recommendations For versions 5.15.0 through 6.27.5, update to version 6.27.6 or later to resolve the issue.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2023-26089

Produtos afetados

Iuclid

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-26089 · Nota de Segurança
• https://iuclid6.echa.europa.eu/download · Nota
• https://iuclid6.echa.europa.eu · Nota
• https://t.me/cibsecurity/63182 · Publicação no Telegram
• https://t.me/cvenotify/109227 · Publicação no Telegram
• https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26089 · Aviso do Fabricante