Lucene search

[email protected]CVE-2023-6554

HistoryJan 11, 2024 - 4:15 p.m.

CVE-2023-6554

2024-01-1116:15:54

CWE-862

[email protected]

web.nvd.nist.gov

cve-2023-6554

admin folder

authorization mechanisms

apache basic auth

sensitive information

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

28.9%

JSON

When access to the “admin” folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers.

CPENameOperatorVersion
tecnick:tcexamtecnick tcexamlt15.1.0
tecnick:tcexamtecnick tcexameq11.0.003
tecnick:tcexamtecnick tcexameq11.3.005
tecnick:tcexamtecnick tcexameq11.1.005
tecnick:tcexamtecnick tcexameq11.1.006
tecnick:tcexamtecnick tcexameq11.1.009
tecnick:tcexamtecnick tcexameq14.5.1
tecnick:tcexamtecnick tcexameq12.2.0
tecnick:tcexamtecnick tcexameq14.8.2
tecnick:tcexamtecnick tcexameq11.2.016

CPE	Name	Operator	Version
tecnick:tcexam	tecnick tcexam	lt	15.1.0
tecnick:tcexam	tecnick tcexam	eq	11.0.003
tecnick:tcexam	tecnick tcexam	eq	11.3.005
tecnick:tcexam	tecnick tcexam	eq	11.1.005
tecnick:tcexam	tecnick tcexam	eq	11.1.006
tecnick:tcexam	tecnick tcexam	eq	11.1.009
tecnick:tcexam	tecnick tcexam	eq	14.5.1
tecnick:tcexam	tecnick tcexam	eq	12.2.0
tecnick:tcexam	tecnick tcexam	eq	14.8.2
tecnick:tcexam	tecnick tcexam	eq	11.2.016

Rows per page:

1-10 of 1791

References

cert.pl/en/posts/2024/01/CVE-2023-6554/

cert.pl/posts/2024/01/CVE-2023-6554/

tcexam.org/

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

28.9%

JSON

Related for CVE-2023-6554

prion1 osv1 cvelist1