Skip to main content

Cbot Core CVE-2023-2884

CRITICAL
Use of Insufficiently Random Values (CWE-330)
2023-05-25 iletisim@usom.gov.tr
Information Disclosure Cbot Core Cbot Panel
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 25, 2023 - 09:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

AnalysisAI

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.0.3.4 Panel:. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-330. Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.0.3.4 Panel: v4.0.3.7. Affected products include: Cbot Cbot Core, Cbot Cbot Panel.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cbot Core

View all
CVE-2023-2882 CRITICAL
9.8 May 25

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.0.3.4

CVE-2023-2887 CRITICAL
9.8 May 25

Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass.0.3.4 Panel: v4.0.3.7. Rate
CVE-2023-2883 HIGH
8.8 May 25

Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authenticati
CVE-2023-2885 HIGH
8.1 May 25

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot a
CVE-2023-2886 MEDIUM
4.3 May 25

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipu

Same weakness CWE-330 – Use of Insufficiently Random Values

View all
CVE-2017-6026 CRITICAL POC
9.1
CVE-2022-36536 CRITICAL POC
9.8
CVE-2026-27637 CRITICAL POC
9.8
CVE-2022-44938 CRITICAL POC
9.8
CVE-2022-22922 CRITICAL POC
9.8
CVE-2021-41694 CRITICAL POC
9.8
CVE-2021-28024 CRITICAL POC
9.8
CVE-2021-27200 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-2884 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy