Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: CBOT Component: Cbot Core Clear all filters
TI-2023-02706 CVE-2023-2887 · GHSA-93j5-g9f6-h7xv

User Authentication Bypass in CBOT's Chatbot

Priority MEDIUM 50

Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00765 Published 2023-05-25 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 CWE-290
TI-2023-02705 CVE-2023-2886 · GHSA-2f92-w7w3-5wxq

Cross-Site WebSocket Hijacking in CBOT's Chatbot

Priority LOW 19

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00208 Published 2023-05-25 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 CWE-1385
TI-2023-02704 CVE-2023-2885 · GHSA-788j-v5xm-h2mq

Channel Accessible by Non-Endpoint in CBOT's Chatbot

Priority LOW 37

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00297 Published 2023-05-25 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 CWE-924
TI-2023-02703 CVE-2023-2884 · GHSA-9hvx-xh5r-79rw

Insecure Randomness in CBOT's Chatbot

Priority MEDIUM 50

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00692 Published 2023-05-25 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 CWE-330
TI-2023-02702 CVE-2023-2883 · GHSA-jm8f-qrph-485q

IDOR in CBOT's Chatbot

Priority MEDIUM 41

Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00683 Published 2023-05-25 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 CWE-639
TI-2023-02701 CVE-2023-2882 · GHSA-8rc5-7hhh-7rpr

Privilege Escalation in CBOT's Chatbot

Priority MEDIUM 50

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0064 Published 2023-05-25 Fixed in Core: v4.0.3.4 Panel: v4.0.3.7 CWE-1270