5.3 - CVE-2023-1663

Executive Summary

Informations
Name	CVE-2023-1663	First vendor Publication	2023-03-29
Vendor	Cve	Last vendor Modification	2023-11-07

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Overall CVSS Score	5.3
Base Score	5.3	Environmental Score	5.3
impact SubScore	1.4	Temporal Score	5.3
Exploitabality Sub Score	3.9

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	None
Scope	Unchanged	Confidentiality Impact	Low
Integrity Impact	None	Availability Impact	None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a result, the downloads directory and its contents are accessible.� 5.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C)

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1663

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-425	Direct Request ('Forced Browsing')

CPE : Common Platform Enumeration

Type	Description	Count
Application	Synopsys Coverity cpe:2.3:a:synopsys:coverity::::::::	1

Sources (Detail)

Source	Url
MISC	https://community.synopsys.com/s/article/Mitigation-for-Coverity-Platforms-Ex... https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-20...