CVE-2023-38257

Published Jul 18, 2023

Last updated a year ago

Overview

Description: Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:iagona:scrutisweb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3972C062-588A-4705-91CE-4427085B46CF",
            "versionEndIncluding": "2.1.37"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References