« Volver al listado

CVE-2023-25263

Estado: ModificadaMedia (5.5)—

In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Stimulsoft — Designer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-25263",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-25263",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-19T15:47:33.456572Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-03-27T21:15:11.093",
  "references": [
    {
      "url": "https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cves.at/posts/cve-2023-25263/writeup/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cves.at/posts/cve-2023-25263/writeup/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems."
    }
  ],
  "lastModified": "2026-07-09T01:18:09.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:desktop:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9E87AC3-EDEA-405B-9837-E72E152AAD22"
            },
            {
              "criteria": "cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:web:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4481FACF-9808-45D8-A888-4625AE2CCB4E"
            },
            {
              "criteria": "cpe:2.3:a:stimulsoft:designer:2023.1.5:*:*:*:desktop:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51B83B01-2BE1-46B9-AE72-80A09FADD589"
            },
            {
              "criteria": "cpe:2.3:a:stimulsoft:designer:2023.1.5:*:*:*:web:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3171A392-E37D-4800-A358-56291DF7590B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}