CVE-2023-5515

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Nov 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-55165.3Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information CVE-2023-55177.5A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is co CVE-2023-55194.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in CVE-2023-55207.7Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-55219.8Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.CVE-2023-55224.3Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emoj CVE-2023-55237.8Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS CVE-2023-55247.3Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows CVE-2023-55254.3The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing CVE-2023-55278.0The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-CVE-2023-55288.8A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escal CVE-2023-55294.8The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high pri