CVE-2023-43805highCWE-287

CVE-2023-43805: high-severity vulnerability in nexryai nexkey

Nexkey allows users to bypass authentication of Bull dashboard

Published · Updated

Follow this CVE+ Monitor nexkey

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
nexryai · nexkey
Related CVEs — nexryai nexkey

In the same product, most dangerous first.

CVE-2023-52077HIGHExternal apps using tokens issued by administrators and moderators can call admin APIsEPSS 0.7%CVE-2023-49095HIGHnexkey allows arbitrary users to impersonate any remote user due to missing signature validationEPSS 0.6%