In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NStimulsoft Designer
APPStimulsoft2023.1.42023.1.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2023-25261CRITICAL9.8PL ✓same product
RCE w Stimulsoft Designer i Viewer — brak ograniczeń dostępu do systemu plików
CVE-2023-25260HIGH7.5same product
Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
CVE-2023-25262HIGH7.5same product
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe R...
CVE-2024-24398CRITICAL9.8PL ✓same vendor
Path Traversal umożliwiający RCE w Stimulsoft Dashboard.JS
CVE-2021-42777CRITICAL9.8PL ✓same vendor
RCE w Stimulsoft Reports — wykonanie kodu C# przez raport