CVE-2023-39375 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
INCD	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 36%

Vendor	Product	Version
siberiancms	siberiancms	4.0.0 ≤ 𝑥 < 4.20.44
siberiancms	siberiancms	5.0.0 ≤ 𝑥 < 5.0.4

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-274 - Improper Handling of Insufficient Privileges
The software does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
CWE-269 - Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References

https://www.gov.il/en/Departments/faq/cve_advisories

https://www.gov.il/en/Departments/faq/cve_advisories