CVE-2023-39423

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-394248.8A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary cont CVE-2023-394257.8Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalatio CVE-2023-394277.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation o CVE-2023-394295.4Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary s CVE-2023-394310.0Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lac CVE-2023-394317.8Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An CVE-2023-394327.8Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticate CVE-2023-394334.4Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escala CVE-2023-394348.8A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma CVE-2023-394359.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 CVE-2023-394365.8SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover informati CVE-2023-394375.4SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets i