CVE-2023-3394

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
fossbilling	fossbilling/fossbilling	>= unspecified, < 0.5.1
fossbilling	fossbilling	< 0.5.1

References

https://github.com/fossbilling/fossbilling/commit/b9c35a174750f1463aea86168524efce6cd48ef7Patch
https://huntr.dev/bounties/84bf3e85-cdeb-4b8d-9ea4-74156dbda83fExploit, Patch, Third Party Advisory
https://github.com/fossbilling/fossbilling/commit/b9c35a174750f1463aea86168524efce6cd48ef7Patch
https://huntr.dev/bounties/84bf3e85-cdeb-4b8d-9ea4-74156dbda83fExploit, Patch, Third Party Advisory

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-339405.4Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before upd CVE-2023-339416.1Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay CVE-2023-339425.4Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Lifera CVE-2023-339435.4Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 th CVE-2023-339446.1Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, an CVE-2023-339458.1SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updat CVE-2023-339464.3The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in differen CVE-2023-339474.3The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by vir CVE-2023-339487.5The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can CVE-2023-339497.5In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email CVE-2023-33956.5All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files c CVE-2023-339507.5Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are