CVE-2023-33243

Katalog CVE

CVSS 8.1 · High EPSS 4,4%

Kerentanan Use of Password Hash With Insufficient Computational Effort pada starface. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash.

Rincian

Terbit di NVD

15 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

4,4% peluang dieksploitasi; lebih tinggi dari 91,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses advisory pihak ketiga
• https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-pos... exploit · advisory pihak ketiga