CVE-2023-33369
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
Risk Assessment
This vulnerability may lead to significant disruptions in system operation, affecting the availability of organizational services.
Recommendation
It is recommended to update to the latest version of IDSecure to mitigate this vulnerability and to monitor the system for potential attack attempts.
Other vulnerabilities in Control ID IDSecure
See all- CVE-2023-33370High
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
- CVE-2023-33368Medium
In Control ID IDSecure versions 4.7.26.0 and prior, some API routes exist that exfiltrate sensitive information and passwords to users accessing these API routes.
Original NVD description (English source)
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.