CVE-2023-33283
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Marval MSM through version 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them using this key.
Risk Assessment
The use of a static encryption key poses a serious risk as attackers can easily decrypt sensitive information, potentially leading to data breaches.
Recommendation
It is recommended to update Marval MSM to the latest version and implement dynamic key management for encryption to enhance data security.
Other vulnerabilities in Marval MSM
See all- CVE-2023-33282Critical
Marval MSM versions up to 14.19.0.12476 and 15.0 have a System account with default credentials. A remote attacker can log in and create a valid session, allowing backend calls to application endpoints.
- CVE-2023-33284High
Marval MSM versions up to 14.19.0.12476 and 15.0 have a Remote Code Execution vulnerability. A remote attacker authenticated as any user can execute code in the context of the web server.
Original NVD description (English source)
Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS