PT-2023-21026 · Makves · Makves Dcap

Ilya Kostyulin · Published 2023-06-21 · Updated 2024-12-06 · CVE-2023-27243

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Makves DCAP version 3.0.0.122

Description The issue allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the "product API". This is an access control issue that can be exploited by sending a specifically designed request to the API endpoint.

Recommendations For Makves DCAP version 3.0.0.122, consider restricting access to the product API until a fix is available. As a temporary workaround, limit the exposure of the API to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-27243

Affected Products

Makves Dcap

References · 8

• https://osv.dev/vulnerability/CVE-2023-27243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27243 · Security Note
• http://makves.com · Note
• https://pastebin.com/L5BkBeEE · Note
• http://dcap.com · Note
• https://t.me/cvenotify/52825 · Telegram Post
• https://t.me/cvenotify/52793 · Telegram Post
• https://t.me/cvenotify/103383 · Telegram Post