Vulnerability · Published Sep 7, 2023 · Assigned by Bitdefender
CVE-2023-39422Use of Hard-coded Credentials in multiple /irmdata/api/ endpoints
Medium 6.5
In plain English
A medium-severity hard-coded credentials in IRM Next Generation from Resort Data Processing, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Resort Data Processing, Inc. | IRM Next Generation | see references |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N