CVE-2023-49565

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint. The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution. Restricting access to the management network with an external firewall can partially mitigate this risk.

• CWE-77

• https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49565/

Published

Sep 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49557An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49558An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49559An issue in vektah gqlparser open-source-library v.2.5.10 al…3.7
• CVE-2023-4956A flaw was found in Quay. Clickjacking is when an attacker u…4.3
• CVE-2023-49563Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v…6.1
• CVE-2023-49564The CBIS/NCS Manager API is vulnerable to an authentication …8.8
• CVE-2023-49566 In Apache Linkis <=1.5.0, due to the lack of effective filt…8.8
• CVE-2023-49567A vulnerability has been identified in the Bitdefender Total…6.8
• CVE-2023-49568A denial of service (DoS) vulnerability was discovered in go…7.5
• CVE-2023-49569A path traversal vulnerability was discovered in go-git vers…9.8
• CVE-2023-4957A vulnerability of authentication bypass has been found on a…4.3
• CVE-2023-49570A vulnerability has been identified in Bitdefender Total Sec…7.4