PT-2023-20479 · European Chemicals Agency · Iuclid

Published 2023-05-02 · Updated 2025-01-30 · CVE-2023-26089

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions European Chemicals Agency IUCLID versions 5.15.0 through 6.27.5

Description The issue allows authentication bypass due to a weak hard-coded secret used for JWT signing.

Recommendations For versions 5.15.0 through 6.27.5, update to version 6.27.6 or later to resolve the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-26089

Affected Products

Iuclid

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-26089 · Security Note
• https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26089 · Vendor Advisory
• https://iuclid6.echa.europa.eu/download · Note
• https://iuclid6.echa.europa.eu · Note
• https://t.me/cibsecurity/63182 · Telegram Post
• https://t.me/cvenotify/109227 · Telegram Post