CVE-2023-34965
Summary
| CVE | CVE-2023-34965 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-06-13 19:15:00 UTC |
| Updated | 2023-06-23 18:14:00 UTC |
| Description | SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information. |
Risk And Classification
Problem Types: CWE-863
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sspanel-uim Project | Sspanel-uim | 2023.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GitHub - Anankke/SSPanel-Uim: SSPanel V3 魔改再次修改版 | MISC | github.com | |
| GitHub - AgentY0/CVE-2023-34965: SSPanel UIM is a multi-purpose agency service sales management system specially designed for Shadowsocks / V2Ray / Trojan protocols. SSPanel-Uim version before 2023.3 does not restrict access to the /link/ interface,which can lead to a leak of user subscription information. | MISC | github.com | |
| The SSPanel-Uim /link/ interface does not limit the request rate, which can lead to brute force guessing of the information on the /link/ interface - Google Docs | MISC | docs.google.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.