CVE-2023-39421

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Sep 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-394229.8The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are howCVE-2023-394239.1The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs,  among other features. By using a UNION SQL operatorCVE-2023-394248.8A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary contCVE-2023-394257.8Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalatioCVE-2023-394277.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation oCVE-2023-394295.4Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary sCVE-2023-394310.0Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lacCVE-2023-394317.8Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. AnCVE-2023-394327.8Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticateCVE-2023-394334.4Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalaCVE-2023-394348.8A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma CVE-2023-394359.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05
CVE-2023-39421: High severity, CVSS 7.7 | Vulnix