CVE-2023-26455CWE-287

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer

Medium · published November 2, 2023

CVSS v3.1
5.6
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-11-02T13:01Z
EPSS history
Timeline
  • 02 NOV 13:01Z
    RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer
    cvelistv5