CVE-2023-38257
published 2023-07-18CVE-2023-38257: Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.64%
46.1th percentile
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| iagona | scrutisweb | <= 2.1.37 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4rcq-f44j-g333: Iagona ScrutisWeb versions 2
ghsa_unreviewed·2023-07-18
CVE-2023-38257 [HIGH] CWE-639 GHSA-4rcq-f44j-g333: Iagona ScrutisWeb versions 2
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.
CISA ICS
Iagona ScrutisWeb
cisa_ics·2023-07-18·CVSS 7.5
[HIGH] Iagona ScrutisWeb
ICS Advisory
##
Iagona ScrutisWeb
Release DateJuly 18, 2023
Alert CodeICSA-23-199-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Iagona
- Equipment: ScrutisWeb
- Vulnerabilities: Absolute Path Traversal, Authorization Bypass Through User-Controlled Key, Use of Hard-coded Cryptographic Key, Unrestricted Upload of File with Dangerous Type
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to upload and execute arbitrary files.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Iagona ScrutisWeb, a web application, are affected:
- ScrutisWeb: Version 2.1.37 and prior
## 3.2 VULNERABILITY OVERVIEW
3.2.1 ABSOLUTE PATH TRAVERSAL C
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-07-18
Published