MEDIUM🇵🇱 Wersja polska

CVE-2023-25263

CVSS 5.5v3.1pub. 2023-03-27upd. 2026-07-05

In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Stimulsoft Designer

    APP
    Stimulsoft
    2023.1.42023.1.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-25261CRITICAL9.8ten sam produkt

Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Des...

CVE-2023-25260HIGH7.5ten sam produkt

Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.

CVE-2023-25262HIGH7.5ten sam produkt

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe R...

CVE-2024-24398CRITICAL9.8PL ✓ten sam vendor

Path Traversal umożliwiający RCE w Stimulsoft Dashboard.JS

CVE-2021-42777CRITICAL9.8ten sam vendor

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execut...