Lucene search
HistoryNov 21, 2023 - 12:15 a.m.
CVE-2023-6144
cve-2023-6144
account takeover
user cookie
security vulnerability
nvd
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
5.1 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%
Dev blog v1.0 allows to exploit an account takeover through the “user” cookie. With this, an attacker can access any user’s session just by knowing their username.
Affected configurations
Node
armanidrisidev_blogMatch1.0
| CPE | Name | Operator | Version |
|---|---|---|---|
| armanidrisi:dev_blog | armanidrisi dev blog | eq | 1.0 |
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Dev Blog",
"vendor": "Dev Blog",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
]Related
cvelist
cvelist
CVE-2023-6144 Dev Blog v1.0 - ATO
2023-11-20 23:20:38
prion
prion
Design/Logic Flaw
2023-11-21 00:15:00
nvd
nvd
CVE-2023-6144
2023-11-21 00:15:07
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
5.1 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%
Related for CVE-2023-6144