CVE-2023-3529 Rotem Dynamics Rotem CRM OTP URI Interface information exposure
Remote attackers can exploit an OTP URI interface discrepancy in Rotem CRM to expose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3529?
CVE-2023-3529 is a medium-severity vulnerability in Rotem CRM, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy. It is possible to initiate the attack remotely. The identifier VDB-233253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-203
Which versions are affected by CVE-2023-3529?
It affects 1 product.
Products include Rotem-Dynamics Rotem Crm.
How do I fix CVE-2023-3529?
No fix has been published for CVE-2023-3529 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-3529 being exploited?
There is no known exploitation of CVE-2023-3529 in the wild and no public exploit code.
Sources
Also known as GHSA-3rx8-q5x6-m56j.