PT-2023-21026 · Makves · Makves Dcap

Ilya Kostyulin · Publicado 2023-06-21 · Atualizado 2024-12-06 · CVE-2023-27243

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Makves DCAP version 3.0.0.122

Description The issue allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the "product API". This is an access control issue that can be exploited by sending a specifically designed request to the API endpoint.

Recommendations For Makves DCAP version 3.0.0.122, consider restricting access to the product API until a fix is available. As a temporary workaround, limit the exposure of the API to minimize the risk of exploitation.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-27243

Produtos afetados

Makves Dcap

Referências · 8

• http://makves.com · Nota
• https://pastebin.com/L5BkBeEE · Nota
• http://dcap.com · Nota
• https://osv.dev/vulnerability/CVE-2023-27243 · Aviso do Fabricante
• https://t.me/cvenotify/52825 · Publicação no Telegram
• https://t.me/cvenotify/52793 · Publicação no Telegram
• https://t.me/cvenotify/103383 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27243 · Nota de Segurança