Paper/Archive/CVE-2023-3237

CVE-2023-3237

VulDB — OTCMS hard-coded password

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 60.7.607 × 2012.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.

Affected

ProductAffectedFixed inSource

OTCMS6.0–CNA

OTCMS6.1–CNA

OTCMS6.2–CNA

OTCMS6.3–CNA

OTCMS6.4–CNA

OTCMS6.5–CNA

OTCMS6.6–CNA

OTCMS6.7–CNA

OTCMS6.8–CNA

OTCMS6.9–CNA

OTCMS6.10–CNA

OTCMS6.11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.231508 refvuldb.com/?ctiid.231508 exploitgithub.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md