CVE-2023-6144 in Dev Blog

Riassunto

di MITRE • 21/11/2023

Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsabile: Fluid Attacks
• Prenotare: 14/11/2023
• Divulgazione: 21/11/2023
• Moderazione: accettato
• Voce: VDB-245866
• CPE: pronto
• CWE: CWE-639 (confermato)
• CVSS: 4.8 (NVD)
• EPSS: 0.00448
• KEV: no
• Attività: molto basso
• Settore: Education

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-6144
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-6144
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-6144/