CVE-2023-4639

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-463937.5gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' pass CVE-2023-463945.4A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web s CVE-2023-463965.4Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters.CVE-2023-46407.5The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This CVE-2023-464009.8KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.CVE-2023-464019.8KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.CVE-2023-464027.5git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.CVE-2023-464049.9PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.CVE-2023-464075.5FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() f CVE-2023-464089.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.CVE-2023-464099.8TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.CVE-2023-46415.5A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second