CVE-2023-48253CWE-89

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request

High · published January 10, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request.

By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00869 · 58.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-01-10T13:02Z
EPSS history
Timeline
  • 10 JAN 13:02Z
    The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request
    cvelistv5