CVE-2023-45282

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published
Oct 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-452837.5The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device pCVE-2023-452845.3On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "CVE-2023-452857.5Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailabCVE-2023-452865.9A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.PooCVE-2023-452877.5Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent tCVE-2023-452887.5An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. MaiCVE-2023-452894.3When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forCVE-2023-452906.5When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValueCVE-2023-452925.3When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a nCVE-2023-45309.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration PanelCVE-2023-453038.8ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supCVE-2023-45319.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software al