CVE-2023-33368: Medium severity assaabloy control id idsecure vulnerability
Published Aug 3, 2023
·Updated
Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.
Affected Software
1 affected component
Assaabloy Control Id Idsecure<=4.7.26.0
Event History
Aug 3, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2023-33368?
CVE-2023-33368 is a vulnerability in Control ID IDSecure 4.7.26.0 and prior that allows sensitive information and passwords to be exfiltrated through certain API routes.
2
What is the severity of CVE-2023-33368?
CVE-2023-33368 has a severity rating of 6.5 (Medium).
3
How does CVE-2023-33368 affect Assaabloy Control ID IDSecure?
CVE-2023-33368 affects Assaabloy Control ID IDSecure version 4.7.26.0 and prior.
4
How can CVE-2023-33368 be fixed?
To fix CVE-2023-33368, it is recommended to update Control ID IDSecure to a version that does not have this vulnerability.
5
What is CWE-668?
CWE-668 is a weakness in the design or implementation of an authentication or authorization scheme, which allows an attacker to bypass security measures.