CVE-2023-48053 Weak cryptography in n/a
Archery uses a static IV in AES CBC encryption, allowing attackers to potentially disclose sensitive information and communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48053?
CVE-2023-48053 is a high-severity vulnerability in n/a, published on 16 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
Weakness: CWE-798
Which versions are affected by CVE-2023-48053?
It affects 1 product.
Products include Archerydms Archery.
How do I fix CVE-2023-48053?
No fix has been published for CVE-2023-48053 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-48053 being exploited?
There is no known exploitation of CVE-2023-48053 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-p7p5-mvjw-h6h6.