CVE-2023-40518

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-405196.1A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts ManagementCVE-2023-40526.5The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be reCVE-2023-405203.3The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to accessCVE-2023-405285.5This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17,CVE-2023-405292.4This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17. A person with physicCVE-2023-40536.5A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URLCVE-2023-405304.7Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2CVE-2023-405318.0Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to exeCVE-2023-405324.3Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial inCVE-2023-405347.5When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST eventCVE-2023-405355.4Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to injCVE-2023-405364.3Race condition for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to po
CVE-2023-40518: High severity, CVSS 7.5 | Vulnix