Skip to main content

Rosariosis CVE-2023-2665

HIGH
Storage of Sensitive Data in a Mechanism without Access Control (CWE-921)
2023-05-12 security@huntr.dev
Information Disclosure Rosariosis
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
May 12, 2023 - 01:15 nvd
HIGH 7.5

DescriptionNVD

Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.

AnalysisAI

Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-921. Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. Affected products include: Rosariosis. Version information: prior to 11.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Rosariosis

View all
CVE-2021-44427 CRITICAL POC
9.8 Nov 29

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allow
CVE-2022-2067 CRITICAL POC
9.1 Jun 13

SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated critical severity (CVSS 9.1), this vul
CVE-2023-0994 HIGH POC
7.5 Feb 24

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8
CVE-2021-45416 MEDIUM POC
6.1 Feb 01

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the
CVE-2020-15718 MEDIUM POC
6.1 Jul 15

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php sc
CVE-2020-15716 MEDIUM POC
6.1 Jul 15

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php scrip
CVE-2022-2714 CRITICAL
9.8 Sep 06

Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0. Rated
CVE-2023-29918 MEDIUM POC
5.4 May 02

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. Rated medium severity (CVSS 5.4), this vulnerab
CVE-2022-3072 MEDIUM POC
5.4 Sep 01

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3. Rated medium severit
CVE-2022-2036 MEDIUM POC
5.4 Jun 09

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. Rated medium severit
CVE-2022-1997 MEDIUM POC
5.4 Jun 08

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated medium severity

CVE-2023-2202 MEDIUM
6.5 Apr 21

Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. Rated medium severity (CVSS 6.5

Same weakness CWE-921 – Storage of Sensitive Data in a Mechanism without Access Control

View all
CVE-2025-30016 CRITICAL
9.8
CVE-2023-41965 HIGH
7.5
CVE-2025-24843 MEDIUM
5.1
CVE-2024-5206 MEDIUM
4.7
CVE-2025-24870 MEDIUM
6.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-2665 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy