CVE-2023-33368 Information disclosure in n/a
Attackers can access exposed API routes to exfiltrate sensitive information and passwords from IDSecure installations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33368?
CVE-2023-33368 is a medium-severity vulnerability in n/a, published on 3 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.
Weakness: CWE-668
Which versions are affected by CVE-2023-33368?
It affects 1 product.
Products include Assaabloy Control Id Idsecure.
How do I fix CVE-2023-33368?
No fix has been published for CVE-2023-33368 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33368 being exploited?
There is no known exploitation of CVE-2023-33368 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-33367 SQL injection in n/a
- CVE-2023-33371 Hardcoded credentials in n/a
- CVE-2025-49853 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premises
- CVE-2023-33369 Path traversal in n/a
- CVE-2025-49851 Improper Authentication in ControlID iDSecure On-premises
Sources
Also known as GHSA-x66f-cjpx-7pq8.