CVE-2023-25263

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25263
In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://stimulsoft.com Product
https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa Broken Link
https://cves.at/posts/cve-2023-25263/writeup/ Exploit Third Party Advisory
http://stimulsoft.com Product
https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa Broken Link
https://cves.at/posts/cve-2023-25263/writeup/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:desktop:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:web:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.5:*:*:*:desktop:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.5:*:*:*:web:*:*:*
History

21 Nov 2024, 07:49

Type Values Removed Values Added
References () http://stimulsoft.com - Product () http://stimulsoft.com - Product
References () https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa - Broken Link () https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa - Broken Link
References () https://cves.at/posts/cve-2023-25263/writeup/ - Exploit, Third Party Advisory () https://cves.at/posts/cve-2023-25263/writeup/ - Exploit, Third Party Advisory

03 Apr 2023, 17:09

Type Values Removed Values Added
References (MISC) https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa - (MISC) https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa - Broken Link
References (MISC) http://stimulsoft.com - (MISC) http://stimulsoft.com - Product
References (MISC) https://cves.at/posts/cve-2023-25263/writeup/ - (MISC) https://cves.at/posts/cve-2023-25263/writeup/ - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-312
CPE cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:desktop:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:web:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.5:*:*:*:web:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.5:*:*:*:desktop:*:*:*
First Time Stimulsoft designer
Stimulsoft

27 Mar 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-27 21:15

Updated : 2024-11-21 07:49

NVD link : CVE-2023-25263

Mitre link : CVE-2023-25263

CVE.ORG link : CVE-2023-25263

JSON object : View

Products Affected

stimulsoft

  • designer
CWE
CWE-312

Cleartext Storage of Sensitive Information