CVE-2023-38492
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-38492 is a vulnerability in the Kirby content management system affecting versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. This issue allows attackers to provide excessively long passwords at the authentication endpoint, potentially causing websites to become unresponsive or unavailable due to the increased processing requirements. The impact is limited as Kirby includes a built-in brute force protection allowing only 10 failed logins per IP and hour per user. The vulnerability has been addressed with password length limits in the patch releases 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. It is recommended to update to these versions to mitigate the vulnerability as well as other security issues.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Getkirby Kirby
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions