CVE-2023-31242

An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability.

• CWE-284
• CWE-287

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1769Exploit, Technical Description, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1769Exploit, Technical Description, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1769Exploit, Technical Description, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1769Exploit, Technical Description, Third Party Advisory

Published

Sep 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31237URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2023-31238A vulnerability has been identified in SICAM P850 (7KG8500-0…4.8
• CVE-2023-31239Stack-based buffer overflow vulnerability in V-Server v4.0.1…7.8
• CVE-2023-3124The Elementor Pro plugin for WordPress is vulnerable to unau…8.8
• CVE-2023-31240Snap One OvrC Pro versions prior to 7.2 have their own local…9.8
• CVE-2023-31241Snap One OvrC cloud servers contain a route an attacker can …10
• CVE-2023-31244 The affected product does not properly va…7.8
• CVE-2023-31245 Devices using Snap One OvrC cloud a…6.1
• CVE-2023-31246Incorrect default permissions in some Intel(R) SDP Tool soft…7.8
• CVE-2023-31247A memory corruption vulnerability exists in the HTTP Server …9.8
• CVE-2023-31248Linux Kernel nftables Use-After-Free Local Privilege Escalat…7.8
• CVE-2023-3125The B2BKing plugin for WordPress is vulnerable to unauthoriz…6.5