The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.
History

Thu, 26 Sep 2024 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Bitdefender

Published: 2023-09-07T12:22:52.239Z

Updated: 2024-09-26T19:12:52.811Z

Reserved: 2023-08-01T15:26:26.149Z

Link: CVE-2023-39422

cve-icon Vulnrichment

Updated: 2024-08-02T18:10:20.742Z

cve-icon NVD

Status : Modified

Published: 2023-09-07T13:15:08.710

Modified: 2024-11-21T08:15:23.767

Link: CVE-2023-39422

cve-icon Redhat

No data.