Paper/Archive/CVE-2023-36649

CVE-2023-36649

mitre — Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to…

EPSS 0.9%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 59.1.591 × 2011.8 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs (as a Granafa authenticated user) or from the Loki REST API without authentication.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refcvcn.gov.it/cvcn/cve/CVE-2023-36649