CVE-2023-33283 Weak cryptography in n/a

Medium 5.5 Published 7 Jun 2023 Updated 7 Jan 2025

An attacker with access to encrypted secrets can decrypt them using a static key, exposing sensitive data in Marval MSM.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33283?

CVE-2023-33283 is a medium-severity vulnerability in n/a, published on 7 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key.

Weakness: CWE-326

Which versions are affected by CVE-2023-33283?

It affects 1 product.

Products include Marvalglobal Msm.

How do I fix CVE-2023-33283?

No fix has been published for CVE-2023-33283 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-33283 being exploited?

There is no known exploitation of CVE-2023-33283 in the wild and no public exploit code.

Sources

Also known as GHSA-9m5v-w59r-w83p.