CVE-2023-45239

A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the tac_plus server.

• CWE-790

• https://github.com/facebook/tac_plus/pull/41Exploit, Patch
• https://github.com/facebook/tac_plus/security/advisories/GHSA-p334-5r3g-4vx3Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4J7ZYMFZB4G4OU5EDJPQLP6F6RKDGIH/Mailing List, Third Party Advisory
• https://github.com/facebook/tac_plus/pull/41Exploit, Patch
• https://github.com/facebook/tac_plus/security/advisories/GHSA-p334-5r3g-4vx3Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4J7ZYMFZB4G4OU5EDJPQLP6F6RKDGIH/Mailing List, Third Party Advisory

Published

Oct 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45232EDK2's Network Package is susceptible to an infinite loop vu…7.5
• CVE-2023-45233EDK2's Network Package is susceptible to an infinite lop vul…7.5
• CVE-2023-45234EDK2's Network Package is susceptible to a buffer overflow v…8.8
• CVE-2023-45235EDK2's Network Package is susceptible to a buffer overflow v…8.8
• CVE-2023-45236EDK2's Network Package is susceptible to a predictable TCP I…7.5
• CVE-2023-45237EDK2's Network Package is susceptible to a predictable TCP I…7.5
• CVE-2023-4524Rejected reason: CVE reject in favor of CVE-2023-40547
• CVE-2023-45240Sensitive information disclosure due to missing authorizatio…5.5
• CVE-2023-45241Sensitive information leak through log files. The following …5.5
• CVE-2023-45242Sensitive information disclosure due to missing authorizatio…5.5
• CVE-2023-45243Sensitive information disclosure due to missing authorizatio…5.5
• CVE-2023-45244Sensitive information disclosure and manipulation due to mis…7.1