CVE-2023-36483

MAS (a Carrier brand) MASmobile Classic Authorization Bypass

State: Published
Severity: 6.5 Medium
Published: Mar 16, 2024
Updated: Aug 28, 2024
Reserved: Jun 22, 2023

Description

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and

MASmobile Classic iOS version 1.7.24 and earlier

which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	Carrier

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
MASmobile ClassicMAS (a Carrier brand)	1 through 1.16.18Affected
MASmobile ClassicMAS (a Carrier brand)	1 through 1.7.24Affected
MAS ASP.Net ServicesMAS (a Carrier brand)	1 through 1.9Affected

References

https://www.corporate.carrier.com/product-security/advisories-resources/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.