CVE-2023-36483

{"id": "CVE-2023-36483", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "productsecurity@carrier.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-03-16T05:15:18.577", "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/", "tags": ["Vendor Advisory", "Not Applicable"], "source": "productsecurity@carrier.com"}, {"url": "https://www.corporate.carrier.com/product-security/advisories-resources/", "tags": ["Vendor Advisory", "Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "productsecurity@carrier.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android\u00a0 version 1.16.18 and earlier and \n\nMASmobile Classic iOS version 1.7.24 and earlier\n\nwhich allows remote attackers to retrieve sensitive data\u00a0 including customer data, security system status, and event history.\n"}, {"lang": "es", "value": "Se descubri\u00f3 una omisi\u00f3n de autorizaci\u00f3n en la aplicaci\u00f3n Carrier MASmobile Classic hasta la versi\u00f3n 1.16.18 para Android, la aplicaci\u00f3n MASmobile Classic hasta la 1.7.24 para iOS y los servicios MAS ASP.Net hasta la 1.9. Esto se puede lograr mediante la predicci\u00f3n de ID de sesi\u00f3n, lo que permite a atacantes remotos recuperar datos confidenciales, incluidos datos de clientes, estado del sistema de seguridad e historial de eventos. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante. Los productos afectados no pueden simplemente actualizarse; deben eliminarse, pero pueden reemplazarse por otro software de Carrier como se explica en el aviso de Carrier."}], "lastModified": "2026-02-18T14:26:08.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:honeywell:masmobile_asp.net_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE09AFA3-320A-4184-8B0E-F3A39DF5CF84", "versionEndIncluding": "1.9"}, {"criteria": "cpe:2.3:a:honeywell:masmobile_classic:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "5B65351B-D5D7-435D-BBE3-AF9EC7788C6F", "versionEndIncluding": "1.7.24"}, {"criteria": "cpe:2.3:a:honeywell:masmobile_classic:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "E2CDD996-54DA-45FF-AC10-7C961A9BF0BE", "versionEndIncluding": "1.16.18"}], "operator": "OR"}]}], "sourceIdentifier": "productsecurity@carrier.com"}