CVE-2023-3265 Auth bypass in PowerPanel Enterprise
An unauthenticated attacker can bypass authentication and log in as administrator by exploiting unsanitized meta-characters in the username field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3265?
CVE-2023-3265 is a critical authentication bypass vulnerability in CyberPower PowerPanel Enterprise, published on 14 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials.
Weakness: CWE-150
Which versions are affected by CVE-2023-3265?
It affects 1 product.
Products include Cyberpower Powerpanel Server.
How do I fix CVE-2023-3265?
No fix has been published for CVE-2023-3265 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-3265 being exploited?
There is no known exploitation of CVE-2023-3265 in the wild and no public exploit code.
Other vulnerabilities in CyberPower PowerPanel Enterprise
Sources
Also known as GHSA-4f45-vh57-p56g.