PT-2024-12557 · Unknown · Masmobile Classic Ios+1

Published 2024-03-15 · Updated 2026-02-18 · CVE-2023-36483

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MASmobile Classic Android versions 1.16.18 and earlier MASmobile Classic iOS versions 1.7.24 and earlier

Description An authorization bypass can be achieved by session ID prediction, allowing remote attackers to retrieve sensitive data including customer data, security system status, and event history.

Recommendations For MASmobile Classic Android versions 1.16.18 and earlier, update to a version later than 1.16.18 to resolve the issue. For MASmobile Classic iOS versions 1.7.24 and earlier, update to a version later than 1.7.24 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-36483

Affected Products

Masmobile Classic Android

Masmobile Classic Ios

References · 8

• https://osv.dev/vulnerability/CVE-2023-36483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36483 · Security Note
• https://corporate.carrier.com/product-security/advisories-resources · Vendor Advisory
• https://t.me/cvenotify/74380 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1768952578765717666 · Twitter Post
• https://t.me/cveNotify/152317 · Telegram Post
• https://twitter.com/CVEnew/status/1768868880351715558 · Twitter Post
• https://t.me/cvenotify/74017 · Telegram Post