CVE-2023-4570

HighCVSS 8.8/10Last modified Nov 11, 2026

Description

An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 and all previous versions of the ni-measurementlink-service Python package.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-420

Affected software

Vendor	Product	Versions
NI	MeasurementLink	>= 1.0.0, <= 1.1.0

References

Timeline

Published: Oct 5, 2023
Last modified: Nov 11, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-457005.4HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leadi CVE-2023-457016.5HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2023-457025.5An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by lo CVE-2023-457037.5HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.CVE-2023-457057.2An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.CVE-2023-457064.0An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configura CVE-2023-457074.4HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. Thi CVE-2023-45718.6In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Stan CVE-2023-457154.3The console may experience a service interruption when processing file names with invalid characters.CVE-2023-457164.1Sametime is impacted by sensitive information passed in URL.CVE-2023-457187.5Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Same CVE-2023-45728.8Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via