CVE-2023-49256CWE-321

Predictable encryption passphrase used in publicly accessible configuration file

High · published January 12, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00466 · 39.3th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2024-01-12T14:24Z
EPSS history
Timeline
  • 12 JAN 14:24Z
    Predictable encryption passphrase used in publicly accessible configuration file
    cvelistv5