CVE-2023-6144 Dev Blog v1.0 - ATO
Attackers can take over any user account by manipulating the user cookie, requiring only the target username.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6144?
CVE-2023-6144 is a critical authentication bypass vulnerability in Dev Blog, published on 20 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.
Weakness: CWE-639
Which versions are affected by CVE-2023-6144?
It affects 1 product.
Products include Armanidrisi Dev Blog.
How do I fix CVE-2023-6144?
No fix has been published for CVE-2023-6144 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-6144 being exploited?
There is no known exploitation of CVE-2023-6144 in the wild and no public exploit code.
Other vulnerabilities in Dev Blog
Sources
Also known as GHSA-w9wh-97qp-xq2v.