Lucene search

[email protected]CVE-2023-50919

HistoryJan 12, 2024 - 8:15 a.m.

CVE-2023-50919

2024-01-1208:15:43

CWE-287

[email protected]

web.nvd.nist.gov

gl.inet

devices

nginx

authentication bypass

lua

pattern matching

cve-2023-50919

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

43.4%

JSON

An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.

Affected configurations

NVD

Node

gl-inetgl-ax1800Match-

AND

gl-inetgl-ax1800_firmwareMatch4.3.7

gl-inetgl-ax1800_firmwareMatch4.4.6

Node

gl-inetgl-axt1800Match-

AND

gl-inetgl-axt1800_firmwareMatch4.3.7

gl-inetgl-axt1800_firmwareMatch4.4.6

Node

gl-inetgl-mt3000Match-

AND

gl-inetgl-mt3000_firmwareMatch4.3.7

gl-inetgl-mt3000_firmwareMatch4.4.6

Node

gl-inetgl-mt2500Match-

AND

gl-inetgl-mt2500_firmwareMatch4.3.7

gl-inetgl-mt2500_firmwareMatch4.4.6

Node

gl-inetgl-mt6000Match-

AND

gl-inetgl-mt6000_firmwareMatch4.3.7

gl-inetgl-mt6000_firmwareMatch4.4.6

Node

gl-inetgl-mt1300Match-

AND

gl-inetgl-mt1300_firmwareMatch4.3.7

gl-inetgl-mt1300_firmwareMatch4.4.6

Node

gl-inetgl-mt300n-v2Match-

AND

gl-inetgl-mt300n-v2_firmwareMatch4.3.7

gl-inetgl-mt300n-v2_firmwareMatch4.4.6

Node

gl-inetgl-ar750s_firmwareMatch4.3.7

gl-inetgl-ar750s_firmwareMatch4.4.6

AND

gl-inetgl-ar750sMatch-

Node

gl-inetgl-ar750_firmwareMatch4.3.7

gl-inetgl-ar750_firmwareMatch4.4.6

AND

gl-inetgl-ar750Match-

Node

gl-inetgl-ar300m_firmwareMatch4.3.7

gl-inetgl-ar300m_firmwareMatch4.4.6

AND

gl-inetgl-ar300mMatch-

Node

gl-inetgl-b1300_firmwareMatch4.3.7

gl-inetgl-b1300_firmwareMatch4.4.6

AND

gl-inetgl-b1300Match-

Node

gl-inetgl-a1300_firmwareMatch4.3.7

gl-inetgl-a1300_firmwareMatch4.4.6

AND

gl-inetgl-a1300Match-

VendorProductVersionCPE
gl-inetgl-ax1800_firmware4.4.6cpe:/o:gl-inet:gl-ax1800_firmware:4.4.6:::
gl-inetgl-ax1800_firmware4.3.7cpe:/o:gl-inet:gl-ax1800_firmware:4.3.7:::