CVE-2023-25263
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In Stimulsoft Designer (Desktop) versions 2023.1.5 and 2023.1.4, after decompiling the Stimulsoft.report.dll library, an attacker can decrypt any connection string stored in .mrt files because a static secret is used. This secret is identical across all tested versions and operating systems.
Risk Assessment
The risk involves potential disclosure of sensitive database credentials, which could lead to unauthorized data access and further attacks on the organization's IT infrastructure.
Recommendation
Immediately update Stimulsoft Designer to the latest available version that fixes this vulnerability, and change all database passwords that may have been stored in .mrt files.
Original NVD description (English source)
In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.