What is the CVSS score of CVE-2023-39338?

CVE-2023-39338 has a CVSS 3.0 base score of 6.8 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 1.3%.

How to fix or mitigate CVE-2023-39338?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review and tighten file/resource permissions.

CVE-2023-39338

EUVD-2023-43069 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-07-12 support@hackerone.com

Information Disclosure

6.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

9.20

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2023-43069

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

CVE Published

Jul 12, 2025 - 04:15 nvd

MEDIUM 6.8

DescriptionCVE.org

Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.