CVE-2023-37291 — Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic Key

CVE-2023-37291

Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic Key PUBLISHED

Description (CNA)

Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through 6.2.0.

Affected (CNA)

Vendor / product	Versions
Galaxy Software Services / Vitals ESP	affected 3.0.8 through 6.2.0

CWE

CWE-321

References

https://www.twcert.org.tw/tw/cp-132-7224-4fe1f-1.html

ADP enrichment

CVE

No English description supplied.

https://www.twcert.org.tw/tw/cp-132-7224-4fe1f-1.html

CISA-ADP

No English description supplied.

No references supplied.