CVE-2023-37288

Name of the Vulnerable Software and Affected Versions SmartBPM.NET (affected versions not specified)

Description The issue concerns a path traversal vulnerability within the file download function of SmartBPM.NET, allowing an unauthenticated remote attacker to access arbitrary system files. Additionally, there is a vulnerability related to the use of a hard-coded authentication key, which can be exploited by an unauthenticated remote attacker to access the system with regular user privileges, enabling them to read application data and execute submission and approval processes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.