CVE-2023-33243
Crypto Weakness in Starface ≤ 7.3.0.10
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-33243 is a high-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability in Starface Starface. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked in the top 9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2023-33243 affects the web interface and REST API of STARFACE, which accept the SHA512 hash of a password for authentication in place of the cleartext password. This behavior negates the protective value of storing only password hashes in the application database, as described in the associated CWE-916 entry, and carries a CVSS 3.1 score of 8.1.
An attacker with network access who has obtained password hashes from a database compromise can authenticate directly to the web interface or REST API as the corresponding user without knowing the original password, resulting in potential full compromise of confidentiality, integrity, and availability.
Public advisories published by RedTeam Pentesting, which discovered the issue, provide further technical detail at the referenced URLs. The EPSS score has remained near 0.13–0.14 with no material upward trajectory after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37412
Vulnerability Data
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's…
more
database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.4.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Information from security contacts highlights password hashing methods with insufficient computational effort, preventing their adoption.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authentication policies may reference password handling but do not address storage or computational cost of hashes.
Proper password hashing is a direct instance of using cryptographic hashes to protect data-at-rest.
Secure development practices explicitly include selection and configuration of strong, computationally expensive password hashes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Requires appropriate use of cryptography, which encompasses selecting strong hashing algorithms for passwords.
Secure coding practices include implementing password storage with adequate computational effort.
Mandates secure authentication mechanisms, directly addressing the need for computationally strong password hashes.