CVE-2023-45292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45292
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 Patch
https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 Patch
https://github.com/mojocn/base64Captcha/issues/120 Exploit Issue Tracking
https://pkg.go.dev/vuln/GO-2023-2386 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mojotv:base64captcha:*:*:*:*:*:go:*:*
History

14 Dec 2023, 16:26

Type Values Removed Values Added
CWE CWE-345
First Time Mojotv base64captcha
Mojotv
CPE cpe:2.3:a:mojotv:base64captcha:*:*:*:*:*:go:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
References () https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - () https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7 - Patch
References () https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - () https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13 - Patch
References () https://github.com/mojocn/base64Captcha/issues/120 - () https://github.com/mojocn/base64Captcha/issues/120 - Exploit, Issue Tracking
References () https://pkg.go.dev/vuln/GO-2023-2386 - () https://pkg.go.dev/vuln/GO-2023-2386 - Third Party Advisory

12 Dec 2023, 13:43

Type Values Removed Values Added
Summary
  • (es) Cuando se utiliza la implementación predeterminada de Verify para verificar un Captcha, se puede omitir la verificación. Por ejemplo, si el primer parámetro es una identificación inexistente, el segundo parámetro es una cadena vacía y el tercer parámetro es verdadero, la función siempre considerará que el Captcha es correcto.

11 Dec 2023, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-11 22:15

Updated : 2023-12-14 16:26

NVD link : CVE-2023-45292

Mitre link : CVE-2023-45292

CVE.ORG link : CVE-2023-45292

JSON object : View

Products Affected

mojotv

  • base64captcha
CWE
CWE-345

Insufficient Verification of Data Authenticity