Galaxy Software Services Vitals ESP is vulnerable to... · CVE-2023-37291 · GitHub Advisory Database · GitHub

Galaxy Software Services Vitals ESP is vulnerable to...

Critical severity Unreviewed Published Jul 21, 2023 to the GitHub Advisory Database • Updated Oct 14, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data.

This issue affects Vitals ESP: from 3.0.8 through 6.2.0.

References

Published by the National Vulnerability Database

Jul 21, 2023

Published to the GitHub Advisory Database Jul 21, 2023

Last updated Oct 14, 2024

Weaknesses

CWE-321

Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. Learn more on MITRE.

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Learn more on MITRE.