CVE-2023-33368
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Control ID IDSecure versions 4.7.26.0 and prior, some API routes exist that exfiltrate sensitive information and passwords to users accessing these API routes.
Risk Assessment
The organization may be exposed to data leaks, potentially leading to unauthorized access to systems and sensitive information.
Recommendation
It is recommended to upgrade to the latest version of Control ID IDSecure to mitigate these security vulnerabilities.
Other vulnerabilities in Control ID IDSecure
See all- CVE-2023-33369Critical
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
- CVE-2023-33370High
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
Original NVD description (English source)
Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.