CVE-2023-2882

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.

This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1270

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-288205.4Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element CVE-2023-288215.3Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.CVE-2023-288237.3Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticatCVE-2023-288244.9Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected pCVE-2023-288265.5This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS MonterCVE-2023-288275.9A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUCVE-2023-288285.9A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vCVE-2023-288298.8A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7CVE-2023-28838.8Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issCVE-2023-288307.8A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Solid Edge SE2022 (All versions < V222.0 Update 13), Solid Edge SE2CVE-2023-288317.5The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application CVE-2023-288327.2A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versi
CVE-2023-2882: Critical severity, CVSS 9.8 | Vulnix