CVE-2023-33730
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
The 'GetUserCurrentPwd' function in Microworld Technologies eScan Management Console contains a privilege escalation vulnerability. This allows a remote attacker to retrieve the password of any user (admin or normal) in plain text format.
Risk Assessment
The organization is at risk of unauthorized access to user accounts, which could lead to serious security breaches and data loss.
Recommendation
It is recommended to update the eScan Management Console to the latest version to mitigate this vulnerability and implement additional security measures such as access monitoring.
Other vulnerabilities in Microworld Technologies eScan Management Console 14.0.1400.2281
See all- CVE-2023-33731Medium
The eScan management console by Microworld Technologies version 14.0.1400.2281 has a reflected Cross Site Scripting (XSS) vulnerability in the view dashboard detail feature. This allows a remote attacker to inject arbitrary code via the URL.
- CVE-2023-33732Medium
The New Policy form in the Microworld Technologies eScan management console has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.
Original NVD description (English source)
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format.