CVE-2023-4138

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
ikus060	ikus060/rdiffweb	>= unspecified, < 2.8.0
ikus-soft	rdiffweb	< 2.8.0

References

https://github.com/ikus060/rdiffweb/commit/feef0d7b11d86aed29bf98c21526088117964d85Patch
https://huntr.dev/bounties/1b1fa915-d588-4bb1-9e82-6a6be79befedExploit, Third Party Advisory
https://github.com/ikus060/rdiffweb/commit/feef0d7b11d86aed29bf98c21526088117964d85Patch
https://huntr.dev/bounties/1b1fa915-d588-4bb1-9e82-6a6be79befedExploit, Third Party Advisory

Timeline

Published: Aug 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-413879.1A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arb CVE-2023-41397.5The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing rest CVE-2023-41408.8The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insuf CVE-2023-41418.8The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->CVE-2023-414199.8An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.CVE-2023-41428.8The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->CVE-2023-414235.4Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payloa CVE-2023-414256.1Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip CVE-2023-414365.4Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additiona CVE-2023-414429.8An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via CVE-2023-414437.2SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parame CVE-2023-414447.8An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400