CVE-2023-45292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45292
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 Patch
https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 Patch
https://github.com/mojocn/base64Captcha/issues/120 Exploit Issue Tracking
https://pkg.go.dev/vuln/GO-2023-2386 Third Party Advisory
https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 Patch
https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 Patch
https://github.com/mojocn/base64Captcha/issues/120 Exploit Issue Tracking
https://pkg.go.dev/vuln/GO-2023-2386 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mojotv:base64captcha:*:*:*:*:*:go:*:*
History

21 Nov 2024, 08:26

Type Values Removed Values Added
References () https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - Patch () https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - Patch
References () https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - Patch () https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - Patch
References () https://github.com/mojocn/base64Captcha/issues/120 - Exploit, Issue Tracking () https://github.com/mojocn/base64Captcha/issues/120 - Exploit, Issue Tracking
References () https://pkg.go.dev/vuln/GO-2023-2386 - Third Party Advisory () https://pkg.go.dev/vuln/GO-2023-2386 - Third Party Advisory

14 Dec 2023, 16:26

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-345
CPE cpe:2.3:a:mojotv:base64captcha:*:*:*:*:*:go:*:*
References () https://pkg.go.dev/vuln/GO-2023-2386 - () https://pkg.go.dev/vuln/GO-2023-2386 - Third Party Advisory
References () https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - () https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - Patch
References () https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - () https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - Patch
References () https://github.com/mojocn/base64Captcha/issues/120 - () https://github.com/mojocn/base64Captcha/issues/120 - Exploit, Issue Tracking

11 Dec 2023, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-11 22:15

Updated : 2024-11-21 08:26

NVD link : CVE-2023-45292

Mitre link : CVE-2023-45292

CVE.ORG link : CVE-2023-45292

JSON object : View

Products Affected

mojotv

  • base64captcha
CWE
CWE-345

Insufficient Verification of Data Authenticity