CVE-2023-4320

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Satellite 6.15 for RHEL 8	—
Red Hat	Red Hat Satellite 6.15 for RHEL 8	—
Red Hat	Red Hat Satellite 6.15 for RHEL 8	—

References

https://access.redhat.com/errata/RHSA-2024:2010
https://access.redhat.com/security/cve/CVE-2023-4320Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2231814Issue Tracking
https://access.redhat.com/errata/RHSA-2024:2010
https://access.redhat.com/security/cve/CVE-2023-4320Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2231814Issue Tracking

Timeline

Published: Dec 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-432009.8D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.CVE-2023-432019.8D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.CVE-2023-432029.8D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vu CVE-2023-432039.8D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.CVE-2023-432049.8D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability CVE-2023-432069.8D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. Thi CVE-2023-432079.8D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vu CVE-2023-432089.8NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability i CVE-2023-43216.1Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.CVE-2023-432169.8SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.CVE-2023-43229.8Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.CVE-2023-432229.8SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.