PT-2023-19459 · Konga · Konga

The_Whovian · Published 2023-04-29 · Updated 2024-05-17 · CVE-2023-2418

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Konga version 2.8.3

Description A problem was found in the Login API component, leading to insufficiently random values. The complexity of an attack is rather high, and the exploitability is difficult. The issue has been disclosed to the public and may be used.

Recommendations For Konga version 2.8.3, it is recommended to change the configuration settings.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2023-2418

GHSA-9G4C-XM3G-F8HQ

Affected Products

Konga

References · 7

• 🔥 https://cnblogs.com/andao/p/17330864.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-2418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2418 · Security Note
• https://vuldb.com/?id.227715 · Note
• https://github.com/advisories/GHSA-9g4c-xm3g-f8hq · Note
• https://vuldb.com/?ctiid.227715 · Note
• https://t.me/cvenotify/49475 · Telegram Post