Lucene search

[email protected]NVD:CVE-2023-7240

HistoryMay 07, 2024 - 1:15 p.m.

CVE-2023-7240

2024-05-0713:15:47

CWE-20

[email protected]

web.nvd.nist.gov

improper authorization

unauthenticated

server side request forgery

open services enumeration

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

An improper authorization level has been detected in the login panel. It may lead to
unauthenticated Server Side Request Forgery and allows to perform open services
enumeration. Server makes query to provided server (Server IP/DNS field) and is
triggering connection to arbitrary address.

References

www.netiq.com/documentation/identity-console/identity_console1720000_releasenotes/data/identity_console1720000_releasenotes.html

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for NVD:CVE-2023-7240

cvelist1 cve1