CVE-2023-26150

2023-10-0305:00:02

snyk

www.cve.org

cve-2023-26150

improper authentication

missing checks

active session

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P

EPSS

0.001

Percentile

33.3%

JSON

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.

Note:

This issue is a result of missing checks for services that require an active session.

CNA Affected

[
  {
    "product": "asyncua",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.9.96",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]