6.3 - CVE-2023-46919

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2023-46919	First vendor Publication	2023-12-27
Vendor	Cve	Last vendor Modification	2024-10-01

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Overall CVSS Score	6.3
Base Score	6.3	Environmental Score	6.3
impact SubScore	5.2	Temporal Score	6.3
Exploitabality Sub Score	1

Attack Vector	Local	Attack Complexity	High
Privileges Required	Low	User Interaction	None
Scope	Unchanged	Confidentiality Impact	High
Integrity Impact	High	Availability Impact	None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application's source code or binary can extract this key & use it decrypt the TLS secret.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46919

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-798	Use of Hard-coded Credentials (CWE/SANS Top 25)

CPE : Common Platform Enumeration

Type	Description	Count
Application	Fedirtsapana Simple Http Server cpe:2.3:a:fedirtsapana:simple_http_server:1.8:::::android::	1
Application	Fedirtsapana Simple Http Server Plus cpe:2.3:a:fedirtsapana:simple_http_server_plus:1.8.1-plus:::::android::	1