CVE-2023-7240

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows to perform open services enumeration. Server makes query to provided server (Server IP/DNS field) and is triggering connection to arbitrary address.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: May 7, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-72417.9Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRS CVE-2023-72428.2Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bou CVE-2023-72439.8Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bou CVE-2023-72449.8Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bou CVE-2023-72457.8The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to CVE-2023-72465.4The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multis CVE-2023-72474.9The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.CVE-2023-72489.8Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect CVE-2023-72499.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows CVE-2023-72505.3A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send CVE-2023-72516.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows CVE-2023-72525.3The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.