CVE-2023-28809

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-384

Affected software

No affected versions have been published.

Timeline

Published: Jun 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-28814.9Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.CVE-2023-288104.3Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify d CVE-2023-288116.5There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area ne CVE-2023-288129.8There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted me CVE-2023-288137.5An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters,CVE-2023-288149.8Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of CVE-2023-288159.8Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerabilit CVE-2023-288185.3An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that cou CVE-2023-288195.4Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder n CVE-2023-28829.8Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatb CVE-2023-288205.4Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element CVE-2023-288215.3Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.