CVE-2023-46919

Name: CVE-2023-46919
Creator: NVD / NIST
Published: 2023-12-27T21:15:08.103+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.3/10EPSS 0.12%

Last modified Jun 17, 2026

CVE-2023-46919 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application's source code or binary can extract this key & use it decrypt the TLS secret.. EPSS estimates a 0.12% chance of exploitation in the next 30 days.

Description

Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application's source code or binary can extract this key & use it decrypt the TLS secret.

Metrics

CVSS 3.1

6.3/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

0.12%

2.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-798

Affected Software

Vendor	Product	Versions
Fedirtsapana	Simple Http Server	1.8
Fedirtsapana	Simple Http Server Plus	1.8.1-plus

References

https://github.com/actuator/com.phlox.simpleserver/blob/main/CWE-321.mdExploit, Third Party Advisory
https://github.com/actuator/com.phlox.simpleserver/blob/main/CWE-321.mdExploit, Third Party Advisory

Timeline

Published: Dec 27, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-46919?

How severe is CVE-2023-46919?

CVE-2023-46919 has a CVSS score of 6.3/10 (MEDIUM severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.

How do I fix CVE-2023-46919?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-46919?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST