GoogleOSV:CVE-2023-26462CVE-2023-26462
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
71.4%
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)
| CPE | Name | Operator | Version |
|---|---|---|---|
| thingsboard | eq | 1.0 | |
| thingsboard | eq | 1.3 | |
| thingsboard | eq | 2.1.3 | |
| thingsboard | eq | 2.0 | |
| thingsboard | eq | 3.4.1 | |
| thingsboard | eq | 1.2.1 | |
| thingsboard | eq | 2.3 | |
| thingsboard | eq | 1.2.3 | |
| thingsboard | eq | 1.2.2 | |
| thingsboard | eq | 2.5 |
Related
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
71.4%