CVE-2023-3237 - OpenCVE

A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:A/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Otcms	Otcms

Configuration 1 [-]

cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md
https://vuldb.com/?ctiid.231508
https://vuldb.com/?id.231508

History

No history.

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2023-06-14T07:31:03.348Z

Updated: 2024-08-02T06:48:08.227Z

Reserved: 2023-06-14T06:12:33.580Z

Link: CVE-2023-3237

Vulnrichment

Updated: 2024-08-02T06:48:08.227Z

NVD

Status : Modified

Published: 2023-06-14T08:15:09.640

Modified: 2024-05-17T02:27:22.640

Link: CVE-2023-3237

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3237", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2023-06-14T06:12:33.580Z", "datePublished": "2023-06-14T07:31:03.348Z", "dateUpdated": "2024-08-02T06:48:08.227Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-02-13T07:34:51.152Z"}, "title": "OTCMS hard-coded password", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-259", "lang": "en", "description": "CWE-259 Use of Hard-coded Password"}]}], "affected": [{"vendor": "n/a", "product": "OTCMS", "versions": [{"version": "6.0", "status": "affected"}, {"version": "6.1", "status": "affected"}, {"version": "6.2", "status": "affected"}, {"version": "6.3", "status": "affected"}, {"version": "6.4", "status": "affected"}, {"version": "6.5", "status": "affected"}, {"version": "6.6", "status": "affected"}, {"version": "6.7", "status": "affected"}, {"version": "6.8", "status": "affected"}, {"version": "6.9", "status": "affected"}, {"version": "6.10", "status": "affected"}, {"version": "6.11", "status": "affected"}, {"version": "6.12", "status": "affected"}, {"version": "6.13", "status": "affected"}, {"version": "6.14", "status": "affected"}, {"version": "6.15", "status": "affected"}, {"version": "6.16", "status": "affected"}, {"version": "6.17", "status": "affected"}, {"version": "6.18", "status": "affected"}, {"version": "6.19", "status": "affected"}, {"version": "6.20", "status": "affected"}, {"version": "6.21", "status": "affected"}, {"version": "6.22", "status": "affected"}, {"version": "6.23", "status": "affected"}, {"version": "6.24", "status": "affected"}, {"version": "6.25", "status": "affected"}, {"version": "6.26", "status": "affected"}, {"version": "6.27", "status": "affected"}, {"version": "6.28", "status": "affected"}, {"version": "6.29", "status": "affected"}, {"version": "6.30", "status": "affected"}, {"version": "6.31", "status": "affected"}, {"version": "6.32", "status": "affected"}, {"version": "6.33", "status": "affected"}, {"version": "6.34", "status": "affected"}, {"version": "6.35", "status": "affected"}, {"version": "6.36", "status": "affected"}, {"version": "6.37", "status": "affected"}, {"version": "6.38", "status": "affected"}, {"version": "6.39", "status": "affected"}, {"version": "6.40", "status": "affected"}, {"version": "6.41", "status": "affected"}, {"version": "6.42", "status": "affected"}, {"version": "6.43", "status": "affected"}, {"version": "6.44", "status": "affected"}, {"version": "6.45", "status": "affected"}, {"version": "6.46", "status": "affected"}, {"version": "6.47", "status": "affected"}, {"version": "6.48", "status": "affected"}, {"version": "6.49", "status": "affected"}, {"version": "6.50", "status": "affected"}, {"version": "6.51", "status": "affected"}, {"version": "6.52", "status": "affected"}, {"version": "6.53", "status": "affected"}, {"version": "6.54", "status": "affected"}, {"version": "6.55", "status": "affected"}, {"version": "6.56", "status": "affected"}, {"version": "6.57", "status": "affected"}, {"version": "6.58", "status": "affected"}, {"version": "6.59", "status": "affected"}, {"version": "6.60", "status": "affected"}, {"version": "6.61", "status": "affected"}, {"version": "6.62", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."}, {"lang": "de", "value": "In OTCMS bis 6.62 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion. Mit der Manipulation des Arguments username/password mit der Eingabe admin mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P"}}], "timeline": [{"time": "2023-06-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2023-06-14T00:00:00.000Z", "lang": "en", "value": "CVE reserved"}, {"time": "2023-06-14T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2023-07-13T09:47:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "p0ison (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.231508", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.231508", "tags": ["signature", "permissions-required"]}, {"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-18T14:44:49.636969Z", "id": "CVE-2023-3237", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T14:46:21.995Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:08.227Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.231508", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.231508", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md", "tags": ["broken-link", "exploit", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.231508", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.231508", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md", "tags": ["broken-link", "exploit", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:08.227Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-3237", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-18T14:44:49.636969Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T14:46:18.451Z"}}], "cna": {"title": "OTCMS hard-coded password", "credits": [{"lang": "en", "type": "reporter", "value": "p0ison (VulDB User)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P"}}], "affected": [{"vendor": "n/a", "product": "OTCMS", "versions": [{"status": "affected", "version": "6.0"}, {"status": "affected", "version": "6.1"}, {"status": "affected", "version": "6.2"}, {"status": "affected", "version": "6.3"}, {"status": "affected", "version": "6.4"}, {"status": "affected", "version": "6.5"}, {"status": "affected", "version": "6.6"}, {"status": "affected", "version": "6.7"}, {"status": "affected", "version": "6.8"}, {"status": "affected", "version": "6.9"}, {"status": "affected", "version": "6.10"}, {"status": "affected", "version": "6.11"}, {"status": "affected", "version": "6.12"}, {"status": "affected", "version": "6.13"}, {"status": "affected", "version": "6.14"}, {"status": "affected", "version": "6.15"}, {"status": "affected", "version": "6.16"}, {"status": "affected", "version": "6.17"}, {"status": "affected", "version": "6.18"}, {"status": "affected", "version": "6.19"}, {"status": "affected", "version": "6.20"}, {"status": "affected", "version": "6.21"}, {"status": "affected", "version": "6.22"}, {"status": "affected", "version": "6.23"}, {"status": "affected", "version": "6.24"}, {"status": "affected", "version": "6.25"}, {"status": "affected", "version": "6.26"}, {"status": "affected", "version": "6.27"}, {"status": "affected", "version": "6.28"}, {"status": "affected", "version": "6.29"}, {"status": "affected", "version": "6.30"}, {"status": "affected", "version": "6.31"}, {"status": "affected", "version": "6.32"}, {"status": "affected", "version": "6.33"}, {"status": "affected", "version": "6.34"}, {"status": "affected", "version": "6.35"}, {"status": "affected", "version": "6.36"}, {"status": "affected", "version": "6.37"}, {"status": "affected", "version": "6.38"}, {"status": "affected", "version": "6.39"}, {"status": "affected", "version": "6.40"}, {"status": "affected", "version": "6.41"}, {"status": "affected", "version": "6.42"}, {"status": "affected", "version": "6.43"}, {"status": "affected", "version": "6.44"}, {"status": "affected", "version": "6.45"}, {"status": "affected", "version": "6.46"}, {"status": "affected", "version": "6.47"}, {"status": "affected", "version": "6.48"}, {"status": "affected", "version": "6.49"}, {"status": "affected", "version": "6.50"}, {"status": "affected", "version": "6.51"}, {"status": "affected", "version": "6.52"}, {"status": "affected", "version": "6.53"}, {"status": "affected", "version": "6.54"}, {"status": "affected", "version": "6.55"}, {"status": "affected", "version": "6.56"}, {"status": "affected", "version": "6.57"}, {"status": "affected", "version": "6.58"}, {"status": "affected", "version": "6.59"}, {"status": "affected", "version": "6.60"}, {"status": "affected", "version": "6.61"}, {"status": "affected", "version": "6.62"}]}], "timeline": [{"lang": "en", "time": "2023-06-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2023-06-14T00:00:00.000Z", "value": "CVE reserved"}, {"lang": "en", "time": "2023-06-14T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2023-07-13T09:47:27.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.231508", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.231508", "tags": ["signature", "permissions-required"]}, {"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."}, {"lang": "de", "value": "In OTCMS bis 6.62 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion. Mit der Manipulation des Arguments username/password mit der Eingabe admin mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-259", "description": "CWE-259 Use of Hard-coded Password"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-02-13T07:34:51.152Z"}}}, "cveMetadata": {"cveId": "CVE-2023-3237", "state": "PUBLISHED", "dateUpdated": "2024-08-02T06:48:08.227Z", "dateReserved": "2023-06-14T06:12:33.580Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2023-06-14T07:31:03.348Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*", "matchCriteriaId": "D15D5B62-76C4-47E8-8039-402DDCC3E233", "versionEndIncluding": "6.62", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad clasificada como cr\u00edtica en OTCMS hasta la versi\u00f3n 6.62. Esta vulnerabilidad afecta a c\u00f3digo desconocido. La manipulaci\u00f3n del argumento \"username/password\" con el input \"admin\" lleva al uso de una contrase\u00f1a embebida. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El identificador de esta vulnerabilidad es VDB-231508. "}], "id": "CVE-2023-3237", "lastModified": "2024-05-17T02:27:22.640", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2023-06-14T08:15:09.640", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://vuldb.com/?ctiid.231508"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.231508"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-259"}], "source": "cna@vuldb.com", "type": "Secondary"}]}