CVE-2023-2903

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229977 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-290307.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290317.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290328.1An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software FoundationCVE-2023-29047.3The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the applCVE-2023-290436.1Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed wCVE-2023-290445.4Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operationCVE-2023-290455.4Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could beCVE-2023-290464.3Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connectioCVE-2023-290477.3Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrarCVE-2023-290488.8A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runCVE-2023-290496.1The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromisedCVE-2023-29058.8Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an