Lucene search

[email protected]NVD:CVE-2023-48253

HistoryJan 10, 2024 - 1:15 p.m.

CVE-2023-48253

2024-01-1013:15:45

CWE-89

[email protected]

web.nvd.nist.gov

vulnerability

remote attacker

authentication

http

exfiltration

password hashes

accounts

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request.
By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.

Affected configurations

NVD

Node

boschnexo-osRange1000–1500-sp2

AND

boschnexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\)Match-

boschnexo_cordless_nutrunner_nxa011s-36v_\(0608842011\)Match-

boschnexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\)Match-

boschnexo_cordless_nutrunner_nxa015s-36v_\(0608842001\)Match-

boschnexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\)Match-

boschnexo_cordless_nutrunner_nxa030s-36v_\(0608842002\)Match-

boschnexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\)Match-

boschnexo_cordless_nutrunner_nxa050s-36v_\(0608842003\)Match-

boschnexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\)Match-

boschnexo_cordless_nutrunner_nxa065s-36v_\(0608842013\)Match-

boschnexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\)Match-

boschnexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\)Match-

boschnexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\)Match-

boschnexo_cordless_nutrunner_nxv012t-36v_\(0608842015\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2272\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2301\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2514\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2515\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2666\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2673\)Match-

References

psirt.bosch.com/security-advisories/BOSCH-SA-711465.html

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

Related for NVD:CVE-2023-48253

cvelist1 prion1 cve1