TI-2023-02706 Aliases CVE-2023-2887 GHSA-93j5-g9f6-h7xv

User Authentication Bypass in CBOT's Chatbot

MEDIUM 50CWE-290Published 2023-05-25 · Updated 2026-05-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00765 55th percentileScored 2026-11-07

Fix Fixed Chatbot (CBOT): Core: v4.0.3.4 Panel: v4.0.3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
CBOT	Chatbot	before Core: v4.0.3.4 Panel: v4.0.3.7	Core: v4.0.3.4 Panel: v4.0.3.7	Patch available	CNA

Chatbot VendorCBOT Affected before Core: v4.0.3.4 Panel: v4.0.3.7 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cbot:cbot_core::::::::	before 4.0.3.4	Vulnerable	CBOT
cpe:2.3:a:cbot:cbot_panel::::::::	before 4.0.3.7	Vulnerable	CBOT

cpe:2.3:a:cbot:cbot_core:*:*:*:*:*:*:*:* Versions before 4.0.3.4 Vulnerable ·CBOT
cpe:2.3:a:cbot:cbot_panel:*:*:*:*:*:*:*:* Versions before 4.0.3.7 Vulnerable ·CBOT

Remediation

Fix · CNA Chatbot (CBOT) Fixed in Core: v4.0.3.4 Panel: v4.0.3.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-05-25
CBOT Chatbot Core: v4.0.3.4 Panel: v4.0.3.7
6 records Highest priority Priority MEDIUM 4 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2023-02703 Insecure Randomness in CBOT's ChatbotPriority MEDIUM 50
- TI-2023-02701 Privilege Escalation in CBOT's ChatbotPriority MEDIUM 50
- TI-2023-02702 IDOR in CBOT's ChatbotPriority MEDIUM 41
Show all 6 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-2887
2026-10-03 Alias added: GHSA-93j5-g9f6-h7xv

References

Advisory 1

https://www.usom.gov.tr/bildirim/tr-23-0293

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0293

TI-2023-02703 Insecure Randomness in CBOT's Chatbot CVSS 3.1CRITICAL 9.8
TI-2023-02701 Privilege Escalation in CBOT's Chatbot CVSS 3.1CRITICAL 9.8
TI-2023-02702 IDOR in CBOT's Chatbot CVSS 3.1HIGH 8.8
TI-2023-02704 Channel Accessible by Non-Endpoint in CBOT's Chatbot CVSS 3.1HIGH 8.1
TI-2023-02705 Cross-Site WebSocket Hijacking in CBOT's Chatbot CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences