CVE-2023-6451

Publicly Known Cryptographic Machine Key In Procura Portal Application

State: Published
Severity: 8.6 High
Published: Feb 16, 2024
Updated: Aug 2, 2024
Reserved: Nov 30, 2023

Description

Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	TML

Weaknesses

CWE-1394

Affected Products

Product	Versions
Procura PortalAlayaCare	before 9.0.1.2Affected

References

https://www.themissinglink.com.au/security-advisories/cve-2023-6451

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.