CVE-2023-1663

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a result, the downloads directory and its contents are accessible. 5.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C)

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-16646.5A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverseCVE-2023-16659.8Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.CVE-2023-16669.8A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerabilitCVE-2023-16676.5A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cauCVE-2023-16688.2A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action mCVE-2023-16697.2The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such CVE-2023-16707.8A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crashCVE-2023-16719.8A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution CVE-2023-16725.3A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window whereCVE-2023-16749.8A vulnerability was found in SourceCodester School Registration and Fee System 1.0 and classified as critical. This issue affects some unknoCVE-2023-16759.8A vulnerability was found in SourceCodester School Registration and Fee System 1.0. It has been classified as critical. Affected is an unknoCVE-2023-16767.8A vulnerability was found in DriverGenius 9.70.0.346. It has been declared as critical. Affected by this vulnerability is the function 0x9C4