What is the CVSS score of CVE-2023-43901?

CVE-2023-43901 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of EMSigner are affected by CVE-2023-43901?

EMSigner v2.8.7 contains an unauthenticated account takeover vulnerability with publicly available exploit code, allowing remote attackers to gain administrative access to any exposed instance…

Is there a public PoC exploit available for CVE-2023-43901?

Yes, a public proof-of-concept exploit is available for CVE-2023-43901. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2023-43901?

Within 24 hours: inventory all EMSigner v2.8.7 deployments and immediately restrict external network access to internet-facing instances using firewall rules, network segmentation, or taking systems offline. Within 7 days: contact the EMSigner vendor to identify available patches or security updates; establish a patching timeline and begin testing in a non-production environment. Within 30 days: deploy vendor patches if available; if no patch is forthcoming, migrate affected systems to an alternative signing solution or implement persistent compensating controls such as reverse-proxy authentication and IP allowlisting.

EMSigner CVE-2023-43901

HIGH

Improper Access Control (CWE-284)

2023-11-14 cve@mitre.org

Authentication Bypass Emsigner

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-accessible with no authentication or complexity barriers; integrity-only impact as privilege modification does not directly expose confidential data or cause availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 27, 2026 - 17:13 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 27, 2026 - 17:07 vuln.today

cvss_changed

Severity Changed

Aug 27, 2026 - 17:07 NVD

MEDIUM HIGH

CVSS changed

Aug 27, 2026 - 17:07 NVD

5.9 (MEDIUM) 7.5 (HIGH)

CVE Published

Nov 14, 2023 - 05:15 nvd

MEDIUM 5.9

DescriptionNVD

Incorrect access control in the AdHoc User creation form of EMSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user.

AnalysisAI

Incorrect access control in EMSigner v2.8.7's AdHoc User creation form permits unauthenticated remote attackers to arbitrarily modify usernames and elevate privileges by supplying the email address of any registered user, requiring no credentials or user interaction. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects a trivial exploitation path against any internet-exposed instance. Publicly available exploit code exists at secpro.llc, though the EPSS score of 0.46% (37th percentile) indicates limited observed widespread exploitation at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

EMSigner is an electronic document signing platform. The vulnerable component is the AdHoc User creation form, which processes user attribute changes - including username and privilege level - without enforcing any authorization check on the requestor's identity. CWE-284 (Improper Access Control) identifies the root cause: the application accepts attacker-controlled input (a registered user's email address) and applies the requested modifications without verifying the requestor holds the right to perform them. The affected product is precisely identified by CPE cpe:2.3:a:emsigner:emsigner:2.8.7:*:*:*:*:*:*:*, pinpointing the single confirmed vulnerable release. Because the form is reachable without authentication and processes privilege-affecting operations, any network-accessible deployment is directly exposed.

RemediationAI

No vendor-released patch is identified at time of analysis - fix version not confirmed from available data. Organizations running EMSigner v2.8.7 should immediately restrict unauthenticated access to the AdHoc User creation endpoint at the network perimeter via web application firewall rules or reverse proxy ACLs that require authentication before reaching that form; note this may disrupt legitimate AdHoc user workflows and should be coordinated with application owners. As an additional compensating control, isolating the EMSigner application to internal networks or VPN-gated access would eliminate exposure to unauthenticated remote attackers, at the trade-off of reduced accessibility for external signatories. All user accounts and privilege assignments should be audited immediately for unauthorized modifications, as prior exploitation may have already occurred. Contact the EMSigner vendor directly regarding an official patch, referencing CVE-2023-43901. The exploit documentation at https://secpro.llc/EMSigner-CVE-1/ can be used to validate WAF rule effectiveness.