CVE-2023-26427

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-922CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jun 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264286.5Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of CVE-2023-264295.3Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedCVE-2023-26439.8A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code CVE-2023-264304.3Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SICVE-2023-264314.3IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accCVE-2023-264324.3When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access tCVE-2023-264334.3When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access tCVE-2023-264344.3When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access tCVE-2023-264355.0It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers coCVE-2023-264368.8Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deCVE-2023-264375.3Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: throCVE-2023-264383.1External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS c
CVE-2023-26427: Low severity, CVSS 3.3 | Vulnix