Marvalglobal vulnerabilities
We track 4 vulnerabilities in Marvalglobal products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 7, 2023.
Latest Marvalglobal vulnerabilities
- 8.8 High severity
Msm: Deserialization of Untrusted Data
Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.
- 9.8 Critical severity
Msm: Incorrect Default Permissions
Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.
- 9.8 Critical severity
Marval Msm: Insufficiently Protected Credentials
Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password.
- 8.8 High severity
Marval Msm: Authorization Bypass Through User-Controlled Key
Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.