CVE-2023-33730

Published May 31, 2023

Last updated 3 months ago

CVSS critical 9.8

Overview

Description: Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-319
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-319

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:escanav:escan_management_console:14.0.1400.2281:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5C9D13C7-6948-4E3A-946C-B291CFBD4D70"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References