CVE-2023-38257

Summary

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.

Affected Software

Weaknesses

• CWE-639 Authorization Bypass Through User-Controlled Key

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-03

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-03

• ←Previous
• Next→