CVE-2023-39421

2023-09-0713:15:08

CWE-798

[email protected]

web.nvd.nist.gov

rdpwin.dll

hardcoded api keys

third-party services

twilio

vonage

unrestricted interaction

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

28.4%

JSON

The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.

Affected configurations

Nvd

Node

resortdatainternet_reservation_module_next_generationMatch5.4.1.23

VendorProductVersionCPE
resortdatainternet_reservation_module_next_generation5.4.1.23cpe:2.3:a:resortdata:internet_reservation_module_next_generation:5.4.1.23:*:*:*:*:*:*:*