CVE-2023-40510
Last modified
CVE-2023-40510 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. EPSS estimates a 1.27% chance of exploitation in the next 30 days.
Description
LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getServerSetting method. The issue results from the exposure of plaintext credentials. An attacker can leverage this vulnerability to bypass authentication on the system. . Was ZDI-CAN-20012.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lg | Simple Editor | 3.21.0 |
References
- https://www.zerodayinitiative.com/advisories/ZDI-23-1214/Third Party Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-23-1214/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-40510?
How severe is CVE-2023-40510?
How do I fix CVE-2023-40510?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-40505LG Simple Editor createThumbnailByMovie Command Injection Re…9.8
- CVE-2023-40506LG Simple Editor copyContent XML External Entity Processing …7.5
- CVE-2023-40507LG Simple Editor copyContent XML External Entity Processing …7.5
- CVE-2023-40508LG Simple Editor putCanvasDB Directory Traversal Arbitrary F…9.1
- CVE-2023-40509LG Simple Editor deleteCanvas Directory Traversal Arbitrary …9.1
- CVE-2023-4051A website could have obscured the full screen notification b…7.5
- CVE-2023-40511LG Simple Editor checkServer Authentication Bypass Vulnerabi…7.5
- CVE-2023-40512LG Simple Editor PlayerController getImageByFilename Directo…6.5
- CVE-2023-40513LG Simple Editor UserManageController getImageByFilename Dir…6.5
- CVE-2023-40514LG Simple Editor FileManagerController getImageByFilename Di…6.5
- CVE-2023-40515LG Simple Editor joinAddUser Improper Input Validation Denia…7.5
- CVE-2023-40516LG Simple Editor Incorrect Permission Assignment Local Privi…7.8
Are you affected by CVE-2023-40510?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST