9.8

CVE-2023-37286

SmartBPM.NET - Use of Hard-Coded Credentials - 1

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Smartsoft ≫ Smartbpm.Net Version6.70
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.84% 0.53
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
twcert@cert.org.tw 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html
Third Party Advisory