Weintek Weincloud
Advisory ansehen veröffentlicht 2023-07-18
Successful exploitation of these vulnerabilities could allow an attacker to utilize the JSON web token (JWT) to reset account passwords, use expired credentials, perform brute force attacks on credentials, or cause a denial-of-service condition.
01
beschreibt (4)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-37362US | high8.8 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to abuse the registration functionality to login with testing credentials to the official website. | ||||
| CVE-2023-35134US | medium5.9 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to reset a password with the corresponding account’s JWT token only.
| ||||
| CVE-2023-34429US | high7.5 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.
| ||||
| CVE-2023-32657US | high7.5 | — | ||
Weintek Weincloud v0.13.6
could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.
| ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-23-199-04 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-23-199-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
Behebungen (4)
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
- MitigationAccount API
Additional mitigations are recommended to help reduce risk:
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan