PT-2025-38296 · Nginx+2 · Nginx+2

Published 2025-09-18 · Updated 2025-10-26 · CVE-2023-49564

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CBIS/NCS Manager (affected versions not specified)

Description The CBIS/NCS Manager API is susceptible to an authentication bypass. An unauthenticated user can gain unauthorized access to API functions by sending a specially crafted HTTP header. This allows attackers to reach restricted or sensitive endpoints of the HTTP API without valid credentials due to a weak verification mechanism within the authentication implementation. The vulnerability resides in the Nginx Podman container on the CBIS/NCS Manager host machine. Restricting access to the management network using an external firewall can partially mitigate the risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2023-49564

Affected Products

Cbis/Ncs Manager

Nginx

Podman

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-49564 · Security Note
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49564 · Note
• https://twitter.com/Komodosec/status/1982265814381420646 · Twitter Post
• https://t.me/pentestingnews/68378 · Telegram Post
• https://twitter.com/CrowdCyber_Com/status/1969020925212348776 · Twitter Post
• https://t.me/CVEtracker/32822 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968608317518860715 · Twitter Post
• https://t.me/cveNotify/135753 · Telegram Post
• https://twitter.com/CVEnew/status/1968923649345302717 · Twitter Post