CVE-2023-48375
Assigner: twcert
Published: 2023-12-15T07:46:16.462Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CWS Web-Base
vendor: SmartStar Software
versions: status: affected
version: v10.25
datePublic: 2023-12-15T07:50:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.
value: SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.
impacts: capecId: CAPEC-665
descriptions: value: CAPEC-665 Exploitation of Thunderbolt Protection Flaws
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

Update to the latest version.

<br>
value: 
Update to the latest version.



source: advisory: TVN-202312005
discovery: EXTERNAL
title: SmartStar Software CWS Web-Base - Broken Access Control
x_generator: engine: Vulnogram 0.1.0-dev