CVE-2023-36649

9.1 criticalEPSS 0.9%

Critical (9.1) in prolion cryptospike. EPSS 0.9% chance of exploitation in the next 30 days.

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs (as a Granafa authenticated user) or from the Loki REST API without authentication.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-532
Published: 2023-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

prolion:cryptospike

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36649
https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36649

Check your stack JSON