Weintek Weincloud
view advisory published 2023-07-18
Successful exploitation of these vulnerabilities could allow an attacker to utilize the JSON web token (JWT) to reset account passwords, use expired credentials, perform brute force attacks on credentials, or cause a denial-of-service condition.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-37362US | high8.8 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to abuse the registration functionality to login with testing credentials to the official website. | ||||
| CVE-2023-35134US | medium5.9 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to reset a password with the corresponding account’s JWT token only.
| ||||
| CVE-2023-34429US | high7.5 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.
| ||||
| CVE-2023-32657US | high7.5 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.
| ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-23-199-04 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-23-199-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (4)
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan