CVE-2023-3350

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532 CWE-327

Affected software

Vendor	Product	Versions
IBERMATICA	IBERMATICA RPS 2019	RPS 2019
ayesa	ibermatica_rps	2019

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019Third Party Advisory

Timeline

Published: Oct 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-335077.5KramerAV VIA GO² < 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read.CVE-2023-335089.8KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).CVE-2023-335099.8KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.CVE-2023-335107.5Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.CVE-2023-335155.4SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.CVE-2023-335177.5carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).CVE-2023-335185.3emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory p CVE-2023-33524.3The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_re CVE-2023-335245.3Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact informa CVE-2023-335286.1halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-335308.8There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web CVE-2023-335329.8There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management p