High severity · published Oct 3, 2023
CVE-2023-3349
Information exposure on IBERMATICA RPS
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables the logging mechanism by generating the log file, which can be downloaded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
IBERMATICA RPS 2019 · IBERMATICA
RPS 2019 · source: vendor
IR
Ibermatica Rps · Ayesa
2019 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3349
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019
More from IBERMATICA RPS 2019
7.5
CVE-2023-3350
Cryptographic Issues on IBERMATICA RPS