CVE-2023-33284
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Marval MSM versions up to 14.19.0.12476 and 15.0 have a Remote Code Execution vulnerability. A remote attacker authenticated as any user can execute code in the context of the web server.
Risk Assessment
This vulnerability allows an attacker to execute code remotely, potentially leading to server takeover and data leakage. Organizations should be aware of the risks associated with unauthorized access to the system.
Recommendation
It is recommended to update Marval MSM to the latest version to mitigate this vulnerability. Additionally, implementing further security measures such as log monitoring and access restrictions is advisable.
Other vulnerabilities in Marval MSM
See all- CVE-2023-33282Critical
Marval MSM versions up to 14.19.0.12476 and 15.0 have a System account with default credentials. A remote attacker can log in and create a valid session, allowing backend calls to application endpoints.
- CVE-2023-33283Medium
Marval MSM through version 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them using this key.
Original NVD description (English source)
Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.