CVE-2023-6451
Auth Bypass in Alayacare Procura ≤ 9.0.1.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-6451 is a high-severity Use of Default Cryptographic Key (CWE-1394) vulnerability in Alayacare Procura. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58688
Vulnerability Data
Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates unique identification and authentication of organizational users before access, directly stopping improper authentication.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
Mandates unique identification and authentication of non-organizational users, directly addressing the weakness for external actors.
Cryptographic key establishment and management requires generating and provisioning unique keys rather than relying on manufacturer defaults.
Requiring the most restrictive configuration settings prohibits the use of known default cryptographic keys.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential/key management practices eliminate default cryptographic keys for identities and services.
Strong authentication requirements implicitly disallow default keys but do not address key management itself.
Configuration management directly prohibits default keys via hardened baselines and change control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.
A.8.19 governs the process, authorization, testing and approval of software installation/updates on operational systems but contains no requirement to replace, avoid or configure away a default cryptographic key that is already present in the installed software.
A.8.24 requires determining and applying appropriate cryptography per policy and classification; it does not stop a default key from being present or from being exploitable when one is used
Security requirements specified early and verified through testing drive the consistent implementation of authentication mechanisms, decreasing the likelihood that authentication steps are omitted or incorrectly applied.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.