Lucene search

[email protected]CVE-2023-33367

HistoryAug 05, 2023 - 2:15 a.m.

CVE-2023-33367

2023-08-0502:15:10

CWE-89

[email protected]

web.nvd.nist.gov

cve-2023-33367

nvd

sql injection

idsecure 4.7.26.0

remote code execution

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

45.1%

JSON

A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server’s root directory, resulting in remote code execution.

Affected configurations

NVD

Node

assaabloycontrol_id_idsecureRange≤4.7.26.0

CPENameOperatorVersion
assaabloy:control_id_idsecureassaabloy control id idsecurele4.7.26.0

CPE	Name	Operator	Version
assaabloy:control_id_idsecure	assaabloy control id idsecure	le	4.7.26.0

References

claroty.com/team82/disclosure-dashboard/cve-2023-33367

www.controlid.com.br/en/access-control/idsecure/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

45.1%

JSON

Related for CVE-2023-33367

nvd1 cvelist1 prion1