CVE-2023-37756
Published: 14 September 2023
Summary
CVE-2023-37756 is a critical-severity Weak Password Requirements (CWE-521) vulnerability in I-Doit I-Doit. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
I-doit pro 25 and below and I-doit open 25 and below contain weak password requirements during Administrator account creation. The flaw is tracked as CWE-521 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions with no required authentication or user interaction.
An unauthenticated attacker can therefore perform brute-force guessing against newly created administrator credentials. Successful compromise grants full control over the application, enabling arbitrary changes to confidentiality, integrity, and availability.
No vendor advisories or patch information appear among the supplied references. The associated EPSS score has remained flat at 0.0813 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-41632
Vulnerability details
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Configuration settings can define and enforce strong password requirements to avoid weak policies.
IA policy establishes password requirements, directly addressing weak password requirements.
Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.
Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.
Facilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.
Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.
Vulnerability scans assess password policies and weak credential requirements against benchmarks.
User documentation on maintaining security includes password requirements, directly mitigating weak password policies.