CVE-2023-5830 : A vulnerability classified as critical has been found in ColumbiaSoft Document L

A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack remotely. Upgrading to version 7.2 SP4 and 2021.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243729 was assigned to this vulnerability.

Published 2023-10-27 21:15:10

Updated 2024-05-17 02:33:21

Source VulDB

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-5830

Documentlocator » Document Locator
Versions before (<) 7.2
cpe:2.3:a:documentlocator:document_locator:*:*:*:*:*:*:*:*
Matching versions
Documentlocator » Document Locator » Version: 7.2
cpe:2.3:a:documentlocator:document_locator:7.2:-:*:*:*:*:*:*
Matching versions
Documentlocator » Document Locator » Version: 7.2 Update SP3
cpe:2.3:a:documentlocator:document_locator:7.2:sp3:*:*:*:*:*:*
Matching versions
Documentlocator » Document Locator » Version: 21
cpe:2.3:a:documentlocator:document_locator:21:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-5830

EPSS FAQ

0.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 83 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-5830

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	VulDB
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.3	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	3.9	3.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	3.9	3.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-5830

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2023-5830

https://vuldb.com/?ctiid.243729

CVE-2023-5830: ColumbiaSoft Document Locator WebTools login improper authentication
Permissions Required
https://vuldb.com/?id.243729

CVE-2023-5830: ColumbiaSoft Document Locator WebTools login improper authentication
Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-5830

Products affected by CVE-2023-5830

Exploit prediction scoring system (EPSS) score for CVE-2023-5830

CVSS scores for CVE-2023-5830

CWE ids for CVE-2023-5830

References for CVE-2023-5830