CVE-2023-22897

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.

• CWE-908
• CWE-908

• http://packetstormsecurity.com/files/171928/SecurePoint-UTM-12.x-Memory-Leak.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Apr/8Exploit, Mailing List, Third Party Advisory
• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txtExploit, Third Party Advisory
• https://rcesecurity.comNot Applicable
• http://packetstormsecurity.com/files/171928/SecurePoint-UTM-12.x-Memory-Leak.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Apr/8Exploit, Mailing List, Third Party Advisory
• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txtExploit, Third Party Advisory
• https://rcesecurity.comNot Applicable

Published

Apr 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22890SmartBear Zephyr Enterprise through 7.15.0 allows unauthenti…7.5
• CVE-2023-22891There exists a privilege escalation vulnerability in SmartBe…8.1
• CVE-2023-22892There exists an information disclosure vulnerability in Smar…7.5
• CVE-2023-22893Strapi through 4.5.5 does not verify the access or ID tokens…7.5
• CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the ad…4.9
• CVE-2023-22895The bzip2 crate before 0.4.4 for Rust allow attackers to cau…7.5
• CVE-2023-22898workers/extractor.py in Pandora (aka pandora-analysis/pandor…6.5
• CVE-2023-22899Zip4j through 2.11.2, as used in Threema and other products,…5.9
• CVE-2023-2290A potential vulnerability in the LenovoFlashDeviceInterface …6.7
• CVE-2023-22900Efence login function has insufficient validation for user i…9.8
• CVE-2023-22901ChangingTec MOTP system has a path traversal vulnerability. …4.9
• CVE-2023-22902Openfind Mail2000 file uploading function has insufficient f…5.4