CVE-2023-26462: High severity thingsboard advancedfeature vulnerability
Published Feb 23, 2023
·Updated
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)
Affected Software
1 affected component
ThingsBoard ThingsBoard=3.4.1
Event History
Feb 23, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-26462.
2
What is the severity of CVE-2023-26462?
The severity of CVE-2023-26462 is high with a severity value of 8.1.
3
What is affected by the CVE-2023-26462 vulnerability?
ThingsBoard version 3.4.1 is affected by the CVE-2023-26462 vulnerability.
4
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by gaining access to the application server or its source code and using the hard-coded service credentials to escalate privileges.
5
Are there any references available for more information?
Yes, you can find more information about CVE-2023-26462 at the following references: [1] [2]