CVE-2023-43805

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-43805", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-09-22T14:51:42.340Z", "datePublished": "2023-10-04T20:24:43.110Z", "dateUpdated": "2024-09-20T14:55:56.424Z"}, "containers": {"cna": {"title": "Nexkey allows users to bypass authentication of Bull dashboard", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf"}, {"name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc", "tags": ["x_refsource_MISC"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc"}, {"name": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d", "tags": ["x_refsource_MISC"], "url": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d"}], "affected": [{"vendor": "nexryai", "product": "nexkey", "versions": [{"version": "< 12.121.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-04T20:24:43.110Z"}, "descriptions": [{"lang": "en", "value": "Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF."}], "source": {"advisory": "GHSA-g8w5-568f-ffwf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:52:11.345Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf"}, {"name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc"}, {"name": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d"}]}, {"affected": [{"vendor": "nexryai", "product": "nexkey", "cpes": ["cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "12.121.9", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-19T18:37:49.613524Z", "id": "CVE-2023-43805", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-20T14:55:56.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf", "name": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc", "name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d", "name": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:52:11.345Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-43805", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-19T18:37:49.613524Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:*:*:*"], "vendor": "nexryai", "product": "nexkey", "versions": [{"status": "affected", "version": "0", "lessThan": "12.121.9", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-20T14:55:50.976Z"}}], "cna": {"title": "Nexkey allows users to bypass authentication of Bull dashboard", "source": {"advisory": "GHSA-g8w5-568f-ffwf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nexryai", "product": "nexkey", "versions": [{"status": "affected", "version": "< 12.121.9"}]}], "references": [{"url": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf", "name": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc", "name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d", "name": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-04T20:24:43.110Z"}}}, "cveMetadata": {"cveId": "CVE-2023-43805", "state": "PUBLISHED", "dateUpdated": "2024-09-20T14:55:56.424Z", "dateReserved": "2023-09-22T14:51:42.340Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-10-04T20:24:43.110Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "nexkey", "vendor": "nexryai", "versions": [{"status": "affected", "version": "< 12.121.9"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "nexkey", "vendor": "nexryai", "versions": [{"lessThan": "12.121.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "68C7C1F9-AD69-45F7-B999-005F4AB9F76D", "versionEndExcluding": "12.121.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF."}, {"lang": "es", "value": "Nexkey es un fork de Misskey, una plataforma de redes sociales descentralizada y de c\u00f3digo abierto. Antes de la versi\u00f3n 12.121.9, la validaci\u00f3n de URL incompleta pod\u00eda permitir a los usuarios omitir la autenticaci\u00f3n para acceder al panel de la cola de trabajos. La versi\u00f3n 12.121.9 contiene una soluci\u00f3n para este problema. Como workaround, es posible evitar esto bloqueando el acceso utilizando herramientas como WAF de Cloudflare."}], "id": "CVE-2023-43805", "lastModified": "2026-06-17T06:26:29.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-43805", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-19T18:37:49.613524Z", "version": "2.0.3"}}]}, "published": "2023-10-04T21:15:10.203", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}