CVE-2023-2844

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
cloudexplorer-dev	cloudexplorer-dev/cloudexplorer-lite	>= unspecified, < v1.1.0

References

https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763aPatch
https://huntr.dev/bounties/6644b36e-603d-4dbe-8ee2-5df8b8fb2e22Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763aPatch
https://huntr.dev/bounties/6644b36e-603d-4dbe-8ee2-5df8b8fb2e22Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: May 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-284402.7Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administr CVE-2023-284417.5smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password sto CVE-2023-284425.3GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.CVE-2023-284435.5Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is no CVE-2023-284447.5angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment v CVE-2023-284459.8Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions t CVE-2023-284468.8Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without CVE-2023-284476.1Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vul CVE-2023-284487.5Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast des CVE-2023-28458.1Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-284507.5An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS CVE-2023-284517.5An issue was discovered in Technitium 11.0.2. There is a vulnerability (called BadDNS) in DNS resolving software, which triggers a resolver