CVE-2023-4659

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-4659

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4659.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-4659

Published

2023-10-02T14:05:20Z

Modified

2026-10-28T02:31:10Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Cross-Site Request Forgery in Free5Gc

Details

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.

Database specific

{
    "cna_assigner":  "INCIBE",
    "cwe_ids":  [
        "CWE-352"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4659.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.1.1"
                        },
                        {
                            "last_affected":  "1.1.1"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/free5gc/webconsole

Affected ranges

Type

GIT

Repo

https://github.com/free5gc/webconsole

Events

Introduced

69864fe682f4d92056ee2714336472612c6955d6

Last Affected

69864fe682f4d92056ee2714336472612c6955d6

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:free5gc:webconsole:1.1.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.1.1"
                },
                {
                    "last_affected":  "1.1.1"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*

1.1.1

v1.*

v1.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4659.json"