CVE-2023-23448 : Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 110021

Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames via analysis of source code.

Published 2023-05-15 11:15:09

Updated 2023-05-25 13:50:48

Source SICK AG

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-23448

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-23448

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	SICK AG
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-23448

CWE-540 Inclusion of Sensitive Information in Source Code

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

Assigned by: psirt@sick.de (Secondary)

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-23448

Products affected by CVE-2023-23448

Sick » Ftmg-esd20axx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esd20axx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esd20axx » Version: N/A
Sick » Ftmg-esd25axx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esd25axx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esd25axx » Version: N/A
Sick » Ftmg-esn40sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esn40sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esn40sxx » Version: N/A
Sick » Ftmg-esn50sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esn50sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esn50sxx » Version: N/A
Sick » Ftmg-esr50sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esr50sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esr50sxx » Version: N/A
Sick » Ftmg-esr40sxx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esr40sxx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esr40sxx » Version: N/A
Sick » Ftmg-esd15axx Firmware
Versions before (<) 2.0
cpe:2.3:o:sick:ftmg-esd15axx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sick » Ftmg-esd15axx » Version: N/A

Vulnerability Details : CVE-2023-23448

Exploit prediction scoring system (EPSS) score for CVE-2023-23448

CVSS scores for CVE-2023-23448

CWE ids for CVE-2023-23448

References for CVE-2023-23448

Products affected by CVE-2023-23448