CVE-2023-48253

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48253
The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:bosch:nexo-os:*:*:*:*:*:*:*:*
OR cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2272\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2301\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2514\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2515\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2666\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2673\):-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2024-01-10 13:15

Updated : 2024-01-17 20:35

NVD link : CVE-2023-48253

Mitre link : CVE-2023-48253

CVE.ORG link : CVE-2023-48253

JSON object : View

Products Affected

bosch

  • nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\)
  • nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\)
  • nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\)
  • nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\)
  • nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\)
  • nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\)
  • nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\)
  • nexo_special_cordless_nutrunner_\(0608pe2515\)
  • nexo-os
  • nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\)
  • nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\)
  • nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\)
  • nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\)
  • nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\)
  • nexo_special_cordless_nutrunner_\(0608pe2301\)
  • nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\)
  • nexo_special_cordless_nutrunner_\(0608pe2673\)
  • nexo_special_cordless_nutrunner_\(0608pe2666\)
  • nexo_special_cordless_nutrunner_\(0608pe2514\)
  • nexo_special_cordless_nutrunner_\(0608pe2272\)
  • nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\)
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')