CVE-2023-33243

Related Files

STARFACE 7.3.0.10 Broken Authentication

Posted Jun 1, 2023

Site redteam-pentesting.de

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash. Versions 7.3.0.10 and below are affected.

tags | exploit, web

advisories | CVE-2023-33243

SHA-256 | bf316bc05bcb273edd4ab75c498cf1dd7821da0c8c8f6d0a7544d4d163c7226f

Download | Favorite | View