Vulnerability Description
A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Assaabloy | Control Id Idsecure | <= 4.7.26.0 |
Related Weaknesses (CWE)
References
- https://claroty.com/team82/disclosure-dashboard/cve-2023-33367Third Party Advisory
- https://www.controlid.com.br/en/access-control/idsecure/Product
- https://claroty.com/team82/disclosure-dashboard/cve-2023-33367Third Party Advisory
- https://www.controlid.com.br/en/access-control/idsecure/Product
FAQ
What is CVE-2023-33367?
CVE-2023-33367 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution...
How severe is CVE-2023-33367?
CVE-2023-33367 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-33367?
Check the references section above for vendor advisories and patch information. Affected products include: Assaabloy Control Id Idsecure.