PT-2023-20655 · Unknown · Thingsboard

Published 2023-02-23 · Updated 2023-08-29 · CVE-2023-26462

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThingsBoard version 3.4.1

Description The issue allows a remote attacker to gain elevated privileges due to hard-coded service credentials being stored in an insecure format. To exploit this, an attacker would need access to the application server or its source code.

Recommendations For ThingsBoard version 3.4.1, consider removing or securely storing the hard-coded service credentials to prevent privilege escalation. As a temporary workaround, restrict access to the application server and its source code to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-26462

Affected Products

Thingsboard

References · 5

• https://osv.dev/vulnerability/CVE-2023-26462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26462 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/238544 · Note
• https://t.me/cibsecurity/58774 · Telegram Post
• https://thingsboard.io/docs/reference/releases · Note