CVE-2023-4659

CRITICAL 9.8CVE-2023-4659 · Published 02/10/2023 · updated 20/10/2026

In short

CVE-2023-4659 is a CRITICAL (CVSS 9.8) vulnerability affecting webconsole (free5gc).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
webconsole free5gc	`= 1.1.1`	No fix yet

Description

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.

References

incibe.es/en/incibe-cert/notices/aviso/cross-site-request-forgery-free5gc · Third Party Advisory

More vulnerabilities in webconsole

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free