CVE-2023-37286

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
References
Link Resource
https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:smartsoft:smartbpm.net:6.70:*:*:*:*:*:*:*

History

13 Jul 2023, 18:59

Type Values Removed Values Added
CPE cpe:2.3:a:smartsoft:smartbpm.net:6.70:*:*:*:*:*:*:*
First Time Smartsoft
Smartsoft smartbpm.net
References (CONFIRM) https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html - (CONFIRM) https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html - Third Party Advisory

10 Jul 2023, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-07-10 02:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-37286

Mitre link : CVE-2023-37286

CVE.ORG link : CVE-2023-37286


JSON object : View

Products Affected

smartsoft

  • smartbpm.net
CWE
CWE-798

Use of Hard-coded Credentials