CVE-2023-2759
Assigner: CERTVDE
Published: 2023-07-17T06:14:15.872Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Core Platform
vendor: TAPHOME
versions: lessThan: 2023.2
status: affected
version: 0.0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Noam Moshe of Claroty Research
descriptions: supportingMedia: base64: no
type: text/html
value: A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability.
value: A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-287
description: CWE-287 Improper Authentication
type: CWE
source: defect: CERT@VDE#64481
discovery: EXTERNAL
title: TAPHOME Improper Authentication in Core Platform
x_generator: engine: Vulnogram 0.1.0-dev