CVE-2023-33282

Published: Jun 7, 2023Modified: Jan 7, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.

Affected (2)

Products: Marvalglobal: Msm

Marvalglobal

1 product

Msm

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Marvalglobal Msm	Up to 14.19.0.12476
Marvalglobal Msm	Version 15.0

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

https://marvalglobal.com/software/

Source: cve@mitre.org

Product

https://www.cyberskydd.se/cve/2023/CVE-2023-33282.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://marvalglobal.com/software/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://www.cyberskydd.se/cve/2023/CVE-2023-33282.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.