Lucene search

GoogleOSV:CVE-2023-38999

HistoryAug 09, 2023 - 7:15 p.m.

CVE-2023-38999

2023-08-0919:15:14

Google

osv.dev

cve-2023-38999

cross-site request forgery

system halt api

opnsense community edition

opnsense business edition

denial of service

crafted get request

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

CPENameOperatorVersion
coreeq15.1.2
coreeq15.1.10.1
coreeq15.1.8.4
coreeq15.1.6
coreeq21.7.r
coreeq18.7.a
coreeq15.1.3
coreeq15.1.4
coreeq23.1.a
coreeq23.1.b

Name	Operator	Version
core	eq	15.1.2
core	eq	15.1.10.1
core	eq	15.1.8.4
core	eq	15.1.6
core	eq	21.7.r
core	eq	18.7.a
core	eq	15.1.3
core	eq	15.1.4
core	eq	23.1.a
core	eq	23.1.b

Rows per page:

1-10 of 731

References

github.com/opnsense/core/commit/5d68f43d1f254144831881fc87d885eed120cf3c

logicaltrust.net/blog/2023/08/opnsense.html

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

Related for OSV:CVE-2023-38999