CVE-2023-2885

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).

This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-924

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-288505.4Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerabi CVE-2023-288515.4Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 CVE-2023-288524.8GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dash CVE-2023-288536.5Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Startin CVE-2023-288548.8nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made availab CVE-2023-288556.5Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access cont CVE-2023-288566.5Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an inval CVE-2023-288577.5Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on c CVE-2023-288583.7redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to CVE-2023-288596.5redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can CVE-2023-28864.3Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue CVE-2023-288629.8An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling d