CVE-2023-37287
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access the system with regular user privilege to read application data and execute submission and approval processes.
Risk Assessment
This vulnerability poses a risk of unauthorized access to application data and the potential for process manipulation, which could lead to serious security breaches.
Recommendation
It is recommended to remove the hard-coded authentication key and implement more secure authentication methods to minimize the risk of unauthorized access.
Original NVD description (English source)
SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.