CVE-2023-33282
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
Marval MSM versions up to 14.19.0.12476 and 15.0 have a System account with default credentials. A remote attacker can log in and create a valid session, allowing backend calls to application endpoints.
Risk Assessment
The risk to the organization is that an attacker could gain access to sensitive data and application functions, potentially leading to serious security breaches.
Recommendation
It is recommended to immediately change the default credentials of the system account and implement additional security measures such as multi-factor authentication.
Other vulnerabilities in Marval MSM
See all- CVE-2023-33284High
Marval MSM versions up to 14.19.0.12476 and 15.0 have a Remote Code Execution vulnerability. A remote attacker authenticated as any user can execute code in the context of the web server.
- CVE-2023-33283Medium
Marval MSM through version 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them using this key.
Original NVD description (English source)
Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.