CVE-2023-22620

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface.

• CWE-863
• CWE-863

• http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Apr/7Exploit, Mailing List, Third Party Advisory
• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txtExploit, Third Party Advisory
• https://rcesecurity.comNot Applicable
• http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Apr/7Exploit, Mailing List, Third Party Advisory
• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txtExploit, Third Party Advisory
• https://rcesecurity.comNot Applicable

Published

Apr 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22614An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O…8.8
• CVE-2023-22615An issue was discovered in IhisiSmm in Insyde InsydeH2O with…8.4
• CVE-2023-22616An issue was discovered in Insyde InsydeH2O with kernel 5.2 …7.8
• CVE-2023-22617A remote attacker might be able to cause infinite recursion …7.5
• CVE-2023-22618If Security Hardening guide rules are not followed, then Nok…7.8
• CVE-2023-2262 A buffer overflow vulnerability exists in the Rockwell Au…9.8
• CVE-2023-22621Strapi through 4.5.5 allows authenticated Server-Side Templa…7.2
• CVE-2023-22622WordPress through 6.1.1 depends on unpredictable client visi…5.3
• CVE-2023-22624Zoho ManageEngine Exchange Reporter Plus before 5708 allows …7.5
• CVE-2023-22626PgHero before 3.1.0 allows Information Disclosure via EXPLAI…7.5
• CVE-2023-22629An issue was discovered in TitanFTP through 1.94.1205. The m…8.8
• CVE-2023-2263 The Rockwell Automation Kinetix 5700 DC Bus Power Supply Se…7.5