CVE-2023-45849

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
HelixHelix Core>= 0.0.0, < 2023.2; >= 0.0.0, < 2023.1 Patch 2; >= 0.0.0, < 2022.2 Patch 3; >= 0.0.0, < 2022.1 Patch 6; >= 0.0.0, < 2021.2 Patch 10

References

Timeline

Published
Nov 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-45858.8Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruptionCVE-2023-458518.8The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.  CVE-2023-458529.8In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands viCVE-2023-458539.8MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,CVE-2023-458547.5A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd pCVE-2023-458557.5qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.CVE-2023-458569.8qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.CVE-2023-458576.5An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-CVE-2023-458588.6A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.CVE-2023-458597.6In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client CVE-2023-45867.4A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when uCVE-2023-458606.5In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises fro
CVE-2023-45849: Critical severity, CVSS 9.8 | Vulnix