CVE-2023-44397CWE-287

CloudExplorer Lite permission bypass vulnerability

High · published October 30, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-10-30T22:28Z
EPSS history
Timeline
  • 30 OCT 22:28Z
    CloudExplorer Lite permission bypass vulnerability
    cvelistv5