← Zuruck zu CVEs
CVE-2023-53895
CRITICAL9.8
Beschreibung
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.
CVE Details
CVSS v3.1 Bewertung9.8
SchweregradCRITICAL
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht12/16/2025
Zuletzt geandert12/30/2025
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
potsky:pimp_my_log
Schwachen (CWE)
CWE-285
Referenzen
https://github.com/potsky/PimpMyLog(disclosure@vulncheck.com)
https://www.exploit-db.com/exploits/51593(disclosure@vulncheck.com)
https://www.pimpmylog.com/(disclosure@vulncheck.com)
https://www.vulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint(disclosure@vulncheck.com)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.