CVEvulnerability

CVE-2023-49564

8.8 HIGH Published 2025-09-18 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-09-18
Last modified
2026-06-17
Assigner
b48c3b8f-639e-4c16-8725-497bc411dad0
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-288

Description

The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root cause of this vulnerability lies in a weak verification mechanism within the authentication implementation present in the Nginx Podman container on the CBIS/NCS Manager host machine. The risk can be partially mitigated by restricting access to the management network using external firewall.

Related

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References