Channel Accessible by Non-Endpoint vulnerability in CBOT... · CVE-2023-2885 · GitHub Advisory Database · GitHub

Channel Accessible by Non-Endpoint vulnerability in CBOT...

High severity Unreviewed Published May 25, 2023 to the GitHub Advisory Database • Updated Apr 4, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Channel Accessible by Non-Endpoint vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

References

Published by the National Vulnerability Database

May 25, 2023

Published to the GitHub Advisory Database May 25, 2023

Last updated Apr 4, 2024

Weaknesses

CWE-300

Channel Accessible by Non-Endpoint

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. Learn more on MITRE.

CWE-924

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission. Learn more on MITRE.