CVE-2023-2886

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.

This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1385CWE-346

Affected software

VendorProductVersions
CBOTChatbot< Core: v4.0.3.4 Panel: v4.0.3.7

References

Timeline

Published
May 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-288629.8An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling dCVE-2023-288639.1AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.CVE-2023-288645.5Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporarCVE-2023-288656.6Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory conteCVE-2023-288665.3In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to CVE-2023-288677.5In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versioCVE-2023-288688.1Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creatinCVE-2023-288696.5Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating systemCVE-2023-28879.8Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0CVE-2023-288706.5Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files CVE-2023-288714.3Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creaCVE-2023-288728.8Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a sy