Information exposure on IBERMATICA RPS
CVE-2023-3349

8.2HIGH

Key Information:

Vendor

Ibermatica

Status
Ibermatica Rps 2019
Vendor
CVE Published:
3 October 2023

What is CVE-2023-3349?

An information exposure vulnerability has been identified in IBERMATICA RPS 2019, enabling unauthenticated users to gain access to sensitive information. By navigating to the URL /RPS2019Service/status.html, attackers can exploit the application's logging functionality, which creates a log file available for download. This log file may contain sensitive data, including usernames, IP addresses, and SQL queries, posing a significant risk to the confidentiality and integrity of the application.

Affected Version(s)

IBERMATICA RPS 2019 RPS 2019

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francisco Javier Medina Munuera
.