Vulnerability · Published Feb 9, 2024 · Assigned by TR-CERT

CVE-2023-6724IDOR in Simgesel Software's Hearing Tracking System (Barosel)

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in Hearing Tracking System from Software Engineering Consultancy Machine Equipment Limited Company. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 48.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse. This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0.

Affected products (as reported)

Vendor	Product	Versions
Software Engineering Consultancy Machine Equipment Limited Company	Hearing Tracking System	0 – before for IOS 7.0, for Android Latest release 1.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.usom.gov.tr/bildirim/tr-24-0099 government-resource, broken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0099 government-resource