{"vulnerability": "CVE-2023-3869", "sightings": [{"uuid": "7d549b31-8583-4011-8d91-a4659aceb684", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38693", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lk33x7nlas2i", "content": "", "creation_timestamp": "2025-03-11T03:13:52.215188Z"}, {"uuid": "4a8c56ca-f24b-4be1-9574-c4065a13be2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38693", "type": "seen", "source": "https://bsky.app/profile/vulnalerts.bsky.social/post/3ljpgzv3e7f2u", "content": "", "creation_timestamp": "2025-03-06T12:00:34.873418Z"}, {"uuid": "4ed22e35-e082-4a52-8d42-52129942796d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38693", "type": "seen", "source": "MISP/fc16b923-3a13-4e9d-9aac-10a57cac12c7", "content": "", "creation_timestamp": "2025-08-18T18:31:00.000000Z"}, {"uuid": "d3337a14-b776-441f-9019-4d86c0cad47b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38693", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6775", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-38693\n\ud83d\udd25 CVSS Score: 9.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.\n\ud83d\udccf Published: 2025-03-05T15:37:55.847Z\n\ud83d\udccf Modified: 2025-03-06T21:58:44.944Z\n\ud83d\udd17 References:\n1. https://github.com/lucee/Lucee/security/advisories/GHSA-vwjx-mmwm-pwrf", "creation_timestamp": "2025-03-06T22:33:45.000000Z"}, {"uuid": "49fd3674-8a84-4a35-88d1-e7d60cfd4e24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38693", "type": "seen", "source": "https://t.me/cvedetector/19643", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2023-38693 - Lucee Server XXE Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2023-38693 \nPublished : March 5, 2025, 4:15 p.m. | 1\u00a0hour, 3\u00a0minutes ago \nDescription : Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-05T18:37:05.000000Z"}, {"uuid": "35cb384b-6f52-4fac-a248-f4aff2c07cf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3869", "type": "seen", "source": "https://t.me/cibsecurity/72665", "content": "\u203c CVE-2023-3869 \u203c\n\nThe wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a comment.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-20T17:22:11.000000Z"}, {"uuid": "ac6bd069-9589-4ea3-99f2-f2df39becb39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3869", "type": "seen", "source": "https://t.me/arpsyndicate/2386", "content": "#ExploitObserverAlert\n\nCVE-2023-3869\n\nDESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-3869. The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a comment.\n\nFIRST-EPSS: 0.000520000\nNVD-IS: 1.4\nNVD-ES: 3.9", "creation_timestamp": "2024-01-03T23:58:44.000000Z"}, {"uuid": "8b19ebf1-7bb9-492f-91c4-5768f06686c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38694", "type": "seen", "source": "https://t.me/ctinow/161830", "content": "https://ift.tt/SwpvN51\nCVE-2023-38694 | Umbraco CMS up to 8.18.9/10.6.x/12.0.x cross site scripting (GHSA-xxc6-35r7-796w)", "creation_timestamp": "2024-01-02T15:36:19.000000Z"}, {"uuid": "999e2698-b0f0-4067-944f-8d2ccd765622", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38698", "type": "seen", "source": "https://t.me/cibsecurity/67789", "content": "\u203c CVE-2023-38698 \u203c\n\nEthereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22.If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost.Version 0.0.22 contains a patch for this issue. As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-04T22:41:08.000000Z"}, {"uuid": "7e58ca15-16c9-4072-9947-c7a81f8106c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38696", "type": "seen", "source": "https://t.me/cibsecurity/67808", "content": "\u203c CVE-2023-38696 \u203c\n\n** REJECT ** This CVE has been rejected because it is unclear whether the issue rests in the original repository `microsoft/ContosoAir`, the forked repository `Apetree100122/ContosoAir`, or both. If the Microsoft repository is vulnerable, [Microsoft](https://www.cve.org/PartnerInformation/ListofPartners/partner/microsoft) is the appropriate CVE Numbering Authority.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-05T00:41:05.000000Z"}, {"uuid": "b91fae86-1da9-4b14-bbfa-6fbb011fc248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38697", "type": "seen", "source": "https://t.me/cibsecurity/67800", "content": "\u203c CVE-2023-38697 \u203c\n\nprotocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-04T22:41:25.000000Z"}, {"uuid": "fa5e7f57-609f-464d-ba3d-66e2a00b09d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38692", "type": "seen", "source": "https://t.me/cibsecurity/67792", "content": "\u203c CVE-2023-38692 \u203c\n\nCloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-04T22:41:14.000000Z"}, {"uuid": "9420f017-1f15-4d11-a1e3-6c28246cc89b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38690", "type": "seen", "source": "https://t.me/cibsecurity/67778", "content": "\u203c CVE-2023-38690 \u203c\n\nmatrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-04T20:41:08.000000Z"}]}