CVE-2023-37287

SmartBPM.NET - Use of Hard-Coded Credentials - 2

State: Published
Severity: 9.1 Critical
Published: Jul 10, 2023
Updated: Mar 19, 2026
Reserved: Jun 30, 2023

Description

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	twcert

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
SmartBPM.NETSamrtSoft	6.70Affected

References

https://www.twcert.org.tw/tw/cp-132-7222-cdfd0-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.