CVE-2023-26455

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Nov 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264565.4Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at theCVE-2023-264576.1SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilitCVE-2023-264588.7An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAPCVE-2023-264597.4Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 7CVE-2023-26464.5A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an unCVE-2023-264605.3Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functioCVE-2023-264614.9SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML pCVE-2023-264628.1ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escCVE-2023-264639.8strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes witCVE-2023-264647.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that CVE-2023-264656.1Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-264667.8A user with non-Admin access can change a configuration file on the client to modify the Server URL.