CVE-2023-46906 juzawebCMS Incorrect Access Control vulnerability
Attackers can cause a denial of service in Juzaweb by sending unvalidated payloads in the timezone field, leading to application outages.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46906?
CVE-2023-46906 is a medium-severity missing authorization vulnerability in n/a, published on 9 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.
Weakness: CWE-863
Which versions are affected by CVE-2023-46906?
2 open source packages ship an affected version, including juzaweb/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
juzaweb/cms Packagist | All versions to 3.4 | None |
juzaweb/cms Packagist | All versions to 3.4 | None |
Products include Juzaweb Cms.
How do I fix CVE-2023-46906?
No fix has been published for CVE-2023-46906 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-46906 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46906 exists.
Other vulnerabilities in n/a
- CVE-2023-46467 Cross-site scripting in n/a
- CVE-2025-6735 juzaweb CMS Import Page imports improper authorization
- CVE-2025-6736 juzaweb CMS Add New Themes Page install improper authorization
- CVE-2025-5421 juzaweb CMS Plugin Editor Page editor access control
- CVE-2025-5422 juzaweb CMS Email Logs Page email access control
Sources
Also known as GHSA-93p6-9cxv-5rpq.