Cyber Resilience

CVE-2023-3064

HighPublic PoC

Published: 05 June 2023

Published
05 June 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0036 58.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-3064 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mobatime Amxgt 100. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 41.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mobatime
amxgt 100
≤ 1.3.20

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-922

Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.

addresses: CWE-200 CWE-922

Requiring equivalent controls at the alternate storage site prevents unauthorized exposure of sensitive backup data.

addresses: CWE-200 CWE-922

Protecting confidentiality of backup information prevents unauthorized exposure of sensitive data stored in backups.

addresses: CWE-200 CWE-922

Policies mandate protection of CUI on external systems, directly reducing unauthorized exposure of sensitive information.

addresses: CWE-200 CWE-922

Categorization identifies sensitive data so that confidentiality protections commensurate with impact level are selected and documented.

addresses: CWE-200 CWE-922

Encrypting or otherwise protecting data at rest directly prevents unauthorized actors from reading sensitive information stored on disk or other media.

addresses: CWE-200 CWE-922

Fragmentation across systems ensures that exposure from any single component yields only incomplete information, directly reducing the impact of unauthorized disclosure.

addresses: CWE-200 CWE-922

OPSEC controls directly protect supply chain information from unauthorized observation or disclosure.

References