CVE-2023-36483 MAS (a Carrier brand) MASmobile Classic Authorization Bypass
Attackers can bypass authorization via session ID prediction to access sensitive customer and security data in MASmobile Classic apps.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36483?
CVE-2023-36483 is a medium-severity authentication bypass vulnerability in MAS ASP.Net Services, published on 16 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and
MASmobile Classic iOS version 1.7.24 and earlier
which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.
Weakness: CWE-639
Which versions are affected by CVE-2023-36483?
It affects 2 products.
Products include Honeywell Masmobile Asp.net Services, Honeywell Masmobile Classic.
How do I fix CVE-2023-36483?
No fix has been published for CVE-2023-36483 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-36483 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36483 exists.
Sources
Also known as GHSA-vcjf-9862-c2x8.