CVE-2023-43320
Last modified
CVE-2023-43320 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.. EPSS estimates a 0.99% chance of exploitation in the next 30 days.
Description
An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Proxmox | Backup Server | >= 1.1, <= 3.0 |
| Proxmox | Proxmox Mail Gateway | >= 7.1, <= 8.0 |
| Proxmox | Virtual Environment | >= 5.4, <= 8.0 |
References
- https://bugzilla.proxmox.com/show_bug.cgi?id=4579Issue Tracking, Vendor Advisory
- https://bugzilla.proxmox.com/show_bug.cgi?id=4584Issue Tracking, Vendor Advisory
- https://bugzilla.proxmox.com/show_bug.cgi?id=4579Issue Tracking, Vendor Advisory
- https://bugzilla.proxmox.com/show_bug.cgi?id=4584Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-43320?
How severe is CVE-2023-43320?
How do I fix CVE-2023-43320?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-4331Broadcom RAID Controller web interface is vulnerable has an …7.5
- CVE-2023-43314** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerabi…7.5
- CVE-2023-43317An issue in Coign CRM Portal v.06.06 allows a remote attacke…8.8
- CVE-2023-43318TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201…8.8
- CVE-2023-43319Cross Site Scripting (XSS) vulnerability in the Sign-In page…6.1
- CVE-2023-4332Broadcom RAID Controller web interface is vulnerable due to …7.5
- CVE-2023-43321File Upload vulnerability in Digital China Networks DCFW-180…8.8
- CVE-2023-43322ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5…8.8
- CVE-2023-43323mooSocial 3.1.8 is vulnerable to external service interactio…6.5
- CVE-2023-43325A reflected cross-site scripting (XSS) vulnerability in the …6.1
- CVE-2023-43326A reflected cross-site scripting (XSS) vulnerability exisits…6.1
- CVE-2023-4333Broadcom RAID Controller web interface doesn’t enforce SSL c…5.5
Are you affected by CVE-2023-43320?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST