Lucene search

MitreCVE-2023-48028

HistoryNov 18, 2023 - 12:15 a.m.

CVE-2023-48028

2023-11-1800:15:07

CWE-307

mitre

web.nvd.nist.gov

cve-2023-48028

kodbox

security flaw

user enumeration

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

43.4%

JSON

kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack.

Affected configurations

Nvd

Node

kodcloudkodboxMatch1.46.01

VendorProductVersionCPE
kodcloudkodbox1.46.01cpe:2.3:a:kodcloud:kodbox:1.46.01:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kodcloud	kodbox	1.46.01	cpe:2.3:a:kodcloud:kodbox:1.46.01:::::::*

References

gist.github.com/bugplorer/9ae8ad7a9f2a3053ebd07a1b7b54deae

nitipoom-jar.github.io/CVE-2023-48028/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

43.4%

JSON

Related for CVE-2023-48028