High severity · published Oct 18, 2023
CVE-2023-45912
WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and…
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Comscale · Wipotec
4.3.29.21344; 4.4.12.723 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45912
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45912
github.com
https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2023-45912
Exploit
https://github.com/PostalBlab/Vulnerabilities/blob/main/ComScale/file_access.txt
More from Comscale
9.8
CVE-2023-45911
An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password