CVE-2023-37291 Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic Key
An unauthenticated remote attacker can use a hard-coded cryptographic key to generate valid tokens, allowing unauthorized access to system processes and data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-37291?
CVE-2023-37291 is a high-severity vulnerability in Galaxy Software Services Vitals ESP, published on 21 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data.
This issue affects Vitals ESP: from 3.0.8 through 6.2.0.
Weakness: CWE-321
Which versions are affected by CVE-2023-37291?
It affects 1 product.
Products include Gss Vitals Enterprise Social Platform.
How do I fix CVE-2023-37291?
No fix has been published for CVE-2023-37291 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-37291 being exploited?
There is no known exploitation of CVE-2023-37291 in the wild and no public exploit code.
Other vulnerabilities in Galaxy Software Services Vitals ESP
Sources
Also known as GHSA-pf66-674w-hm6h.