CVE-2023-45292

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

• CWE-345

• https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7Patch
• https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13Patch
• https://github.com/mojocn/base64Captcha/issues/120Exploit, Issue Tracking
• https://pkg.go.dev/vuln/GO-2023-2386Third Party Advisory
• https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7Patch
• https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13Patch
• https://github.com/mojocn/base64Captcha/issues/120Exploit, Issue Tracking
• https://pkg.go.dev/vuln/GO-2023-2386Third Party Advisory

Published

Dec 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45286A race condition in go-resty can result in HTTP request body…5.9
• CVE-2023-45287Before Go 1.20, the RSA based TLS key exchanges used the mat…7.5
• CVE-2023-45288An attacker may cause an HTTP/2 endpoint to read arbitrary a…7.5
• CVE-2023-45289When following an HTTP redirect to a domain which is not a s…4.3
• CVE-2023-45290When parsing a multipart form (either explicitly with Reques…6.5
• CVE-2023-45291Rejected reason: reserved but not needed
• CVE-2023-4530Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-45303ThingsBoard before 3.5 allows Server-Side Template Injection…8.8
• CVE-2023-4531Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-45311fsevents before 1.2.11 depends on the https://fsevents-binar…9.8
• CVE-2023-45312In the mtproto_proxy (aka MTProto proxy) component through 0…8.8
• CVE-2023-45315Improper initialization in some Intel(R) Power Gadget softwa…5.5