BlackTreeCVE Intelligence
← Back to the CVE catalogue
Full vulnerability report · 2023
CVE-2023-44270High confidence

The vulnerability affects linters using PostCSS to parse external untrusted CSS

Unknown · Unknown

5.3MediumCVSS 3.1
Recommended action
Scheduled

Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.

Patch available
R
Operational reassessment

Published severity in operational context

Open reassessment dashboard →
Published severityMediumOperational priority:Medium, unchanged from published severity.unchanged

Evidence used

  • No CISA KEV confirmation is currently recorded.
  • The selected CVSS metric records a network-reachable, unauthenticated path with no user interaction.
  • EPSS is 0.97% for the current model date.

Compensating controls

  • Validate the affected product branch and deploy the verified fixed release.
  • Restrict the affected network interface to trusted sources where business-safe.
  • Monitor vendor guidance and exploitation sources for a material change.

Verification

  1. Confirm that the asset runs Unknown Unknown and falls inside the recorded affected range.
  2. Verify the installed build against the product-specific fixed version after deployment.
  3. Validate exposure, authentication requirements and compensating controls in the actual environment.
  4. Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Mitigation target: As exposure requiresRemediation target: Within 365 days

This automated reassessment organises public evidence. It does not know asset exposure, business impact or control effectiveness and does not replace CVSS or a human risk decision.

Distribution package intelligence

Release-specific package status

Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.

5 package states
Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Distribution releaseSource packageVendor stateFixed versionEvidence
Debian trixietrixie · sourcenode-postcssVendor fix publishedDebian records a fixed source-package version for this release.8.4.31+~cs8.0.26-1Debian Security Tracker ↗Source updated 6 Oct 2026
Debian bookwormbookworm · sourcenode-postcssVendor fix publishedDebian records a fixed source-package version for this release.8.4.20+~cs8.0.23-1+deb12u1Debian Security Tracker ↗Source updated 6 Oct 2026
Debian forkyforky · sourcenode-postcssVendor fix publishedDebian records a fixed source-package version for this release.8.4.31+~cs8.0.26-1Debian Security Tracker ↗Source updated 6 Oct 2026
Debian sidsid · sourcenode-postcssVendor fix publishedDebian records a fixed source-package version for this release.8.4.31+~cs8.0.26-1Debian Security Tracker ↗Source updated 6 Oct 2026
Ubuntu 24.04 LTSnoble · standard archivenode-postcssUnder evaluationCanonical reports that the package might be affected and still needs evaluation or fixing.Not published in this feedCanonical Ubuntu Security ↗Source updated 5 Oct 2026
Open-source package ranges2 source-attributed ranges

These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.

Ecosystem and packageAffected rangeFirst fixed versionEvidence
npmpostcss< 8.4.318.4.31GitHub advisory ↗github reviewed aggregator · 4 Nov 2025
npmpostcssSEMVER: introduced 0; fixed 8.4.318.4.31OSV record ↗aggregator derived · 10 Sep 2026
Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

1 current
CVE-2023-44270 · CSAF 2.0 · revision 3 · finalRed Hat Product SecurityPostCSS: Improper input validation in PostCSS
72 known affected

The vendor explicitly identifies these products as affected by this CVE.

  • io.cryostat-cryostat3.src as a component of Cryostat 3
  • openshift-logging/kibana6-rhel8 as a component of Logging Subsystem for Red Hat OpenShift
  • openshift-logging/logging-view-plugin-rhel8 as a component of Logging Subsystem for Red Hat OpenShift
  • mta/mta-cli-rhel9 as a component of Migration Toolkit for Applications 7
  • mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 7
  • rhmtc/openshift-migration-ui-rhel8 as a component of Migration Toolkit for Containers
  • migration-toolkit-virtualization/mtv-console-plugin-rhel9 as a component of Migration Toolkit for Virtualization
  • multicluster-engine/console-mce-rhel8 as a component of Multicluster Engine for Kubernetes
  • workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator
  • openshift-lightspeed-tech-preview/lightspeed-console-plugin-rhel9.src as a component of OpenShift Lightspeed
  • openshift-pipelines/pipelines-console-plugin-rhel8 as a component of OpenShift Pipelines
  • openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines
Summary
There's a flaw in the PostCSS package where it fails to properly validate the input CSS, causing commented lines to be interpreted as code. An attacker may leverage that by crafting a CSS file with comments containing CSS code in order to force PostCSS to include the malicious CSS elements in its output. An successful attack may lead to integrity impact as it may inject elements in a web page when parsing untrusted CSS input.
Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Choose official national sources for this report. Each advisory shows its original language. Your selection is remembered on this device and included in shared links.

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current
ENISA EUVD identifier

EUVD-2023-2456

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state
Present in the current official mapping
Known exploitation
Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score
Not supplied in the stored EUVD record
Advisory evidence
No linked advisory details stored yet
Recommended actionScheduled

Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.

Patch available
01

What, why and how

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

What

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Why

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Why

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path
a network path → Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface
Network
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
Low: no specialised conditions are recorded
Security boundary
Unchanged: impact remains within the vulnerable component's security authority
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-74 ↗

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.

AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CNoneConfidentiality impact: No direct loss is represented by this metric.ILowIntegrity impact: A successful attack can cause a limited loss.ANoneAvailability impact: No direct loss is represented by this metric.
Post-exploitation / living off the land
No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
NetworkUnauthenticatedCWE-74
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

BSI · German · WID-SEC-2026-0180Dell Data Protection Advisor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.

Official advisory ↗
BSI · German · WID-SEC-2024-0858IBM QRadar SIEM: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Phishing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.

Official advisory ↗
BSI · German · WID-SEC-2023-2964Splunk Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Code auszuführen und um nicht näher spezifizierte Auswirkungen zu erzielen.

Official advisory ↗
BSI · German · WID-SEC-2024-3577Red Hat OpenShift: Schwachstelle ermöglicht Manipulation von Daten

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Daten zu manipulieren.

Official advisory ↗
BSI · German · WID-SEC-2024-0753IBM Business Automation Workflow: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.

Official advisory ↗
Cyber Security Agency of Singapore · English · CSA-SB-20231004Security Bulletin 04 Oct 2023

The Cyber Security Agency of Singapore included this CVE in its official Security Bulletin 04 Oct 2023, published on 4 October 2023. Open the linked bulletin for the product, severity and reference information published in that issue.

Official advisory ↗
CERT-FR · French · CERTFR-2026-AVI-1233Multiples vulnérabilités dans les produits IBM

ecord?id=CVE-2022-25883 Référence CVE CVE-2022-2596 https://www.cve.org/CVERecord?id=CVE-2022-2596 Référence CVE CVE-2022-35948 https://www.cve.org/CVERecord?id=CVE-2022-35948 Référence CVE CVE-2022-35961 https://www.cve.org/CVERecord?id=CVE-2022-35961 Référence CVE CVE-2022-37620 https://www.cve.org/CVERecord?id=CVE-2022-37620 Référence CVE CVE-2022-46175 https://www.cve.org/CVERecord?id=CVE-2022-46175 Référence CVE CVE-2022-46337 https://www.cve.org/CVERecord?id=CVE-2022-46337 Référence CVE CVE-2023-0842 https://www.cve.org/CVERecord?id=CVE-2023-0842 Référence CVE CVE-2023-26158 https://www.cve.org/CVERecord?id=CVE-2023-26158 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-45133 https://www.cve.org/CVERecord?id=CVE-2023-45133 Référence CVE CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 Référence CVE CVE-2024-22195 https://www.cve.org/CVERecord?id=CVE-2024-22195 Référence CVE CVE-2024-29041 https://www.cve.org/CVERecord?id=CVE-2024-29041 Référence CVE CVE-2024-34064 https://www.cve.org/CVERecord?id=CVE-2024-34064 Référence CVE CVE-2024-37890 https://www.cve.org/CVERecord?id=CVE-2024-37890 Référence CVE CVE-2024-4067 https://www.cve.org/CVERecord?id=CVE-2024-4067 Référence CVE CVE-2024-4068 https://www.cve.org/CVERecord?id=CVE

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0627Multiples vulnérabilités dans les produits IBM

rt/pages/node/7240530 Référence CVE CVE-2021-3121 https://www.cve.org/CVERecord?id=CVE-2021-3121 Référence CVE CVE-2021-38561 https://www.cve.org/CVERecord?id=CVE-2021-38561 Référence CVE CVE-2022-24999 https://www.cve.org/CVERecord?id=CVE-2022-24999 Référence CVE CVE-2022-25883 https://www.cve.org/CVERecord?id=CVE-2022-25883 Référence CVE CVE-2023-26115 https://www.cve.org/CVERecord?id=CVE-2023-26115 Référence CVE CVE-2023-26136 https://www.cve.org/CVERecord?id=CVE-2023-26136 Référence CVE CVE-2023-32305 https://www.cve.org/CVERecord?id=CVE-2023-32305 Référence CVE CVE-2023-43804 https://www.cve.org/CVERecord?id=CVE-2023-43804 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-45133 https://www.cve.org/CVERecord?id=CVE-2023-45133 Référence CVE CVE-2023-46298 https://www.cve.org/CVERecord?id=CVE-2023-46298 Référence CVE CVE-2024-1135 https://www.cve.org/CVERecord?id=CVE-2024-1135 Référence CVE CVE-2024-29041 https://www.cve.org/CVERecord?id=CVE-2024-29041 Référence CVE CVE-2024-52046 https://www.cve.org/CVERecord?id=CVE-2024-52046 Référence CVE CVE-2024-5629 https://www.cve.org/CVERecord?id=CVE-2024-5629 Référence CVE CVE-2024-6827 https://www.cve.org/CVERecord?id=CVE-2024-6827 Référence CVE CVE-2024-7254 https://www.cve.org/CVERecord?id=CVE-202

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0021Multiples vulnérabilités dans les produits IBM

d?id=CVE-2022-46751 Référence CVE CVE-2023-26116 https://www.cve.org/CVERecord?id=CVE-2023-26116 Référence CVE CVE-2023-26117 https://www.cve.org/CVERecord?id=CVE-2023-26117 Référence CVE CVE-2023-26118 https://www.cve.org/CVERecord?id=CVE-2023-26118 Référence CVE CVE-2023-26136 https://www.cve.org/CVERecord?id=CVE-2023-26136 Référence CVE CVE-2023-34453 https://www.cve.org/CVERecord?id=CVE-2023-34453 Référence CVE CVE-2023-34454 https://www.cve.org/CVERecord?id=CVE-2023-34454 Référence CVE CVE-2023-34455 https://www.cve.org/CVERecord?id=CVE-2023-34455 Référence CVE CVE-2023-43642 https://www.cve.org/CVERecord?id=CVE-2023-43642 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-5072 https://www.cve.org/CVERecord?id=CVE-2023-5072 Référence CVE CVE-2023-52451 https://www.cve.org/CVERecord?id=CVE-2023-52451 Référence CVE CVE-2023-52463 https://www.cve.org/CVERecord?id=CVE-2023-52463 Référence CVE CVE-2023-52469 https://www.cve.org/CVERecord?id=CVE-2023-52469 Référence CVE CVE-2023-52470 https://www.cve.org/CVERecord?id=CVE-2023-52470 Référence CVE CVE-2023-52471 https://www.cve.org/CVERecord?id=CVE-2023-52471 Référence CVE CVE-2023-52476 https://www.cve.org/CVERecord?id=CVE-2023-52476 Référence CVE CVE-2023-52486 https://www.cve.org/CVERecord?id=CV

Official advisory ↗
CERT-FR · French · CERTFR-2024-AVI-0459Multiples vulnérabilités dans les produits IBM

id=CVE-2022-42004 Référence CVE CVE-2022-46337 https://www.cve.org/CVERecord?id=CVE-2022-46337 Référence CVE CVE-2023-261257 https://www.cve.org/CVERecord?id=CVE-2023-261257 Référence CVE CVE-2023-34462 https://www.cve.org/CVERecord?id=CVE-2023-34462 Référence CVE CVE-2023-36478 https://www.cve.org/CVERecord?id=CVE-2023-36478 Référence CVE CVE-2023-36479 https://www.cve.org/CVERecord?id=CVE-2023-36479 Référence CVE CVE-2023-38729 https://www.cve.org/CVERecord?id=CVE-2023-38729 Référence CVE CVE-2023-40167 https://www.cve.org/CVERecord?id=CVE-2023-40167 Référence CVE CVE-2023-41900 https://www.cve.org/CVERecord?id=CVE-2023-41900 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-44981 https://www.cve.org/CVERecord?id=CVE-2023-44981 Référence CVE CVE-2023-45857 https://www.cve.org/CVERecord?id=CVE-2023-45857 Référence CVE CVE-2023-49083 https://www.cve.org/CVERecord?id=CVE-2023-49083 Référence CVE CVE-2023-49568 https://www.cve.org/CVERecord?id=CVE-2023-49568 Référence CVE CVE-2023-49569 https://www.cve.org/CVERecord?id=CVE-2023-49569 Référence CVE CVE-2023-50782 https://www.cve.org/CVERecord?id=CVE-2023-50782 Référence CVE CVE-2023-51074 https://www.cve.org/CVERecord?id=CVE-2023-51074 Référence CVE CVE-2023-51775 https://www.cve.org/CVERecord?id=

Official advisory ↗
CERT-FR · French · CERTFR-2024-AVI-0366Multiples vulnérabilités dans les produits IBM

d?id=CVE-2023-27561 Référence CVE CVE-2023-28642 https://www.cve.org/CVERecord?id=CVE-2023-28642 Référence CVE CVE-2023-28840 https://www.cve.org/CVERecord?id=CVE-2023-28840 Référence CVE CVE-2023-28841 https://www.cve.org/CVERecord?id=CVE-2023-28841 Référence CVE CVE-2023-28842 https://www.cve.org/CVERecord?id=CVE-2023-28842 Référence CVE CVE-2023-30861 https://www.cve.org/CVERecord?id=CVE-2023-30861 Référence CVE CVE-2023-31484 https://www.cve.org/CVERecord?id=CVE-2023-31484 Référence CVE CVE-2023-32681 https://www.cve.org/CVERecord?id=CVE-2023-32681 Référence CVE CVE-2023-34462 https://www.cve.org/CVERecord?id=CVE-2023-34462 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-44981 https://www.cve.org/CVERecord?id=CVE-2023-44981 Référence CVE CVE-2023-45857 https://www.cve.org/CVERecord?id=CVE-2023-45857 Référence CVE CVE-2023-46136 https://www.cve.org/CVERecord?id=CVE-2023-46136 Référence CVE CVE-2023-5072 https://www.cve.org/CVERecord?id=CVE-2023-5072 Référence CVE CVE-2024-1135 https://www.cve.org/CVERecord?id=CVE-2024-1135 Référence CVE CVE-2024-21334 https://www.cve.org/CVERecord?id=CVE-2024-21334 Référence CVE CVE-2024-21501 https://www.cve.org/CVERecord?id=CVE-

Official advisory ↗
CERT-FR · French · CERTFR-2024-AVI-0330Multiples vulnérabilités dans les produits IBM

48517 Bulletin de sécurité IBM 7148753 du 19 avril 2024 https://www.ibm.com/support/pages/node/7148753 Référence CVE CVE-2018-15494 https://www.cve.org/CVERecord?id=CVE-2018-15494 Référence CVE CVE-2018-6561 https://www.cve.org/CVERecord?id=CVE-2018-6561 Référence CVE CVE-2019-10785 https://www.cve.org/CVERecord?id=CVE-2019-10785 Référence CVE CVE-2020-4051 https://www.cve.org/CVERecord?id=CVE-2020-4051 Référence CVE CVE-2020-5259 https://www.cve.org/CVERecord?id=CVE-2020-5259 Référence CVE CVE-2023-26159 https://www.cve.org/CVERecord?id=CVE-2023-26159 Référence CVE CVE-2023-42282 https://www.cve.org/CVERecord?id=CVE-2023-42282 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2024-20918 https://www.cve.org/CVERecord?id=CVE-2024-20918 Référence CVE CVE-2024-20921 https://www.cve.org/CVERecord?id=CVE-2024-20921 Référence CVE CVE-2024-20926 https://www.cve.org/CVERecord?id=CVE-2024-20926 Référence CVE CVE-2024-20932 https://www.cve.org/CVERecord?id=CVE-2024-20932 Référence CVE CVE-2024-20945 https://www.cve.org/CVERecord?id=CVE-2024-20945 Référence CVE CVE-2024-20952 https://www.cve.org/CVERecord?id=CVE-2024-20952 Référence CVE CVE-2024-22354 https://www.cve.org/CVERecord?id=CVE-2024-22354 Référence CVE CVE-2024-22361 https://www.cve.org/CVERecord?id=

Official advisory ↗
CERT-FR · French · CERTFR-2024-AVI-0145Multiples vulnérabilités dans les produits IBM

CVERecord?id=CVE-2023-40687 Référence CVE CVE-2023-40692 https://www.cve.org/CVERecord?id=CVE-2023-40692 Référence CVE CVE-2023-4128 https://www.cve.org/CVERecord?id=CVE-2023-4128 Référence CVE CVE-2023-4206 https://www.cve.org/CVERecord?id=CVE-2023-4206 Référence CVE CVE-2023-4207 https://www.cve.org/CVERecord?id=CVE-2023-4207 Référence CVE CVE-2023-4208 https://www.cve.org/CVERecord?id=CVE-2023-4208 Référence CVE CVE-2023-42795 https://www.cve.org/CVERecord?id=CVE-2023-42795 Référence CVE CVE-2023-43020 https://www.cve.org/CVERecord?id=CVE-2023-43020 Référence CVE CVE-2023-43642 https://www.cve.org/CVERecord?id=CVE-2023-43642 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-44487 https://www.cve.org/CVERecord?id=CVE-2023-44487 Référence CVE CVE-2023-44981 https://www.cve.org/CVERecord?id=CVE-2023-44981 Référence CVE CVE-2023-45133 https://www.cve.org/CVERecord?id=CVE-2023-45133 Référence CVE CVE-2023-45142 https://www.cve.org/CVERecord?id=CVE-2023-45142 Référence CVE CVE-2023-45178 https://www.cve.org/CVERecord?id=CVE-2023-45178 Référence CVE CVE-2023-45193 https://www.cve.org/CVERecord?id=CVE-2023-45193 Référence CVE CVE-2023-45648 https://www.cve.org/CVERecord?id=CVE-2023-45648 Référence CVE CVE-2023-45803 https://www.cve.org/CVERecord?id=

Official advisory ↗
CERT-FR · French · CERTFR-2023-AVI-1007Multiples vulnérabilités dans les produits IBM

ord?id=CVE-2022-37434 Référence CVE CVE-2023-1370 https://www.cve.org/CVERecord?id=CVE-2023-1370 Référence CVE CVE-2023-28523 https://www.cve.org/CVERecord?id=CVE-2023-28523 Référence CVE CVE-2023-28526 https://www.cve.org/CVERecord?id=CVE-2023-28526 Référence CVE CVE-2023-28527 https://www.cve.org/CVERecord?id=CVE-2023-28527 Référence CVE CVE-2023-32731 https://www.cve.org/CVERecord?id=CVE-2023-32731 Référence CVE CVE-2023-34462 https://www.cve.org/CVERecord?id=CVE-2023-34462 Référence CVE CVE-2023-38003 https://www.cve.org/CVERecord?id=CVE-2023-38003 Référence CVE CVE-2023-43642 https://www.cve.org/CVERecord?id=CVE-2023-43642 Référence CVE CVE-2023-44270 https://www.cve.org/CVERecord?id=CVE-2023-44270 Référence CVE CVE-2023-45133 https://www.cve.org/CVERecord?id=CVE-2023-45133 Gestion détaillée du document le 08 décembre 2023 Version initiale Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos Contact cyber.gouv.fr service-public.fr legifrance.gouv.fr info.gouv.fr france.fr info.gouv.fr/risques Premier Ministre / Secrétariat Général de la Défense et de la Sécurité Nationale / Agence nationale de la sécurité des systèmes d'information

Official advisory ↗
CERT-FR · French · CERTFR-2023-AVI-0956Multiples vulnérabilités dans les produits Splunk

De multiples vulnérabilités ont été découvertes dans les produits Splunk . Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et une injection de code indirecte à distance (XSS).

Official advisory ↗
JVN iPedia · Japanese · JVNDB-2023-013980Node.js 用 PostCSS におけるインジェクションに関する脆弱性

Node.js 用 PostCSS には、インジェクションに関する脆弱性が存在します。

Official advisory ↗
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Patch available
Affected
Fixed
Action
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Workaround
No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04

Evidence and provenance

Published 29 Sept 2023 · Last source change 3 Nov 2025, 21:49 UTC · CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVE recordCVE.org · 5.2
CVSS sourceNIST NVD
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-08-14
European sourceENISA EUVD · EUVD-2023-2456
Product sourceVendor CSAF · Red Hat Product Security
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceNIST NVD
NVD statusNVD modified after enrichment

Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.

Material change intelligence

What changed after publication

View recent updates ↗
  1. Affected versionsThe structured affected or fixed version information changed.
    Before
    n/a · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
    After
    n/a · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
    Red Hat Product Security ↗
  2. Affected versionsThe structured affected or fixed version information changed.
    Before
    io.cryostat-cryostat3.src as a component of Cryostat 3; openshift-logging/kibana6-rhel8 as a component of Logging Subsystem for Red Hat OpenShift; openshift-logging/logging-view-plugin-rhel8 as a component of Logging Subsystem for Red Hat OpenShift; mta/mta-cli-rhel9 as a component of Migration Toolkit for Applications 7; mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 7; rhmtc/openshift-migration-ui-rhel8 as a component of Migration Toolkit for Containers; migration-toolkit-virtualization/mtv-console-plugin-rhel9 as a component of Migration Toolkit for Virtualization; multicluster-engine/console-mce-rhel9 as a component of Multicluster Engine for Kubernetes; workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator; openshift-lightspeed-tech-preview/lightspeed-console-plugin-rhel9.src as a component of OpenShift Lightspeed; openshift-pipelines/pipelines-console-plugin-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-db-migration-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-ui-rhel8 as a component of OpenShift Pipelines; openshift-service-mesh/kiali-ossmc-rhel8 as a component of OpenShift Service Mesh 2; 3scale-amp-system-container as a component of Red Hat 3scale API Management Platform 2; rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 4; aap-cloud-ui-container as a component of Red Hat Ansible Automation Platform 2; ansible-automation-platform-25/lightspeed-rhel8 as a component of Red Hat Ansible Automation Platform 2; io.apicurio-apicurio-registry as a component of Red Hat build of Apicurio Registry 2; rhcl-console-plugin-container as a component of Red Hat Connectivity Link 1; org.infinispan-infinispan-console as a component of Red Hat Data Grid 8; rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub; grafana as a component of Red Hat Enterprise Linux 10; grafana-selinux as a component of Red Hat Enterprise Linux 10; grafana.src as a component of Red Hat Enterprise Linux 10; thunderbird as a component of Red Hat Enterprise Linux 7; thunderbird.src as a component of Red Hat Enterprise Linux 7; grafana as a component of Red Hat Enterprise Linux 8; and 42 more · Fixed: openshift-gitops-1/argo-rollouts-rhel8@sha256:868a4e993d8963e4fb64c1845f54f916f335d3c59f0596e966c6d926373f6ee1_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:9b883e71b2d12f8872b3a37b383087a488f9b74ddde0e0c6daf6ee04bdf15881_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:bf7f9ca8f33c935df306554b778e5291bcff9e92b7e9122498b0ad71d58b9166_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:ce0677023395a6d7c9598b820c6eb73b651eaa698aef9f5c27a25884fba5d643_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:04523979e4ab58120d959f88503957b1e13122952e3de03d9f0540f1e574c0d6_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:64df9d55e7196fe56ebab88071f115d7fea26fa4396109bbf3bae11ffbf1f3a5_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:9017ef8967ebe3a14ea1e07d0a9624ef126b2928e233f09451aeea89a7f09366_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:ecb181ba7dfd4a5cdffa8ba9ca251dc4875ad7f41e9d60c4cc0a3462c233e489_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:050b358e7512599f412fddf711f8731d821223ba76c460b114fe4c4bfaf7cf1b_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:83ba395adbfdae8d4973cea02ead8392089ac1051edd11e7defc6d07a122bca2_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:dc4d641c87a3b65208ef2b46398f64ae69465daeb84b4d1022062d6c5f7347dc_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:e6eba59c8336bde1ed98947b2d4c626feb2113037bc724bd881f25b7f155f47b_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:065b95a1612d15b3a7de1c5822555851535199711cc3890d56d7cb01e01666b3_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:1c59649ad569e25c3445e9655c8061b7f0b769514c0739f2e080216a55ca39c7_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:490512fefae58c6092394c8e751b7c1761583bff23b815e6f1649d55e9d43002_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:605123efdd9f31243e039929322b4a4f6ad160baaebce188fdbf2c4e7ff663ff_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-operator-bundle@sha256:ba442571ef9180765055f5224548c73e3da2be31731f8dd5b6b1beaf3e6732ee_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:1b81b7c26d7a848797f9944254963a89c3f6f0e727355bafcda5e483fee7b848_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:2caf6bd42e10f063d0991740706946d4205bf49540865bd4ed9091176add2aed_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:951de21fc848014beb5db2f7307ef639c6c76ec6eb7036b18c07047c8a914c48_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:ed04d67b3bd9ebc21a0aa2503823e5a476da44caa165999a33670198f5d1be37_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:72e761f1d00b0a322d4a7a10c824fe88e4ac7e156a279694b75ce3b42be0b6d6_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d20615c230e1b888bacdc374763eeca9b1f7612741f8ba52ded483ac688b858d_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d86dcd96af06a338b577d9c940e6316ed9a807b9fc6a33d9f5c96e2b703679b8_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:f07aa6ccdc324a2631fc01b1f4af4317cdc0471c673bd8f5bf24560e0f012dd9_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:30b687a8309c17d5b4f5be6439b59f2dc540a306d625ee34bdf72626dc36c105_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:62e1ab7267cfd3536c3b2ba9592dffb7fb979cbb039a1a90320a03b751d5f728_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:b5ba9620f23fed74b983a090cec19f6ed74ddffdd1be7d9d89f1201c0c83c1b1_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:c0ec76e307a2867dc1064a3470e17a2e1533233e1a119ce5f32e2b3c07428d08_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/must-gather-rhel8@sha256:a909f1ebb5cf719e4308bbd162fea14e66b0ad6f7e91163699e8f9cbf61ec852_arm64 as a component of Red Hat OpenShift GitOps 1.14; and 925 more
    After
    io.cryostat-cryostat3.src as a component of Cryostat 3; openshift-logging/kibana6-rhel8 as a component of Logging Subsystem for Red Hat OpenShift; openshift-logging/logging-view-plugin-rhel8 as a component of Logging Subsystem for Red Hat OpenShift; mta/mta-cli-rhel9 as a component of Migration Toolkit for Applications 7; mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 7; rhmtc/openshift-migration-ui-rhel8 as a component of Migration Toolkit for Containers; migration-toolkit-virtualization/mtv-console-plugin-rhel9 as a component of Migration Toolkit for Virtualization; multicluster-engine/console-mce-rhel8 as a component of Multicluster Engine for Kubernetes; workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator; openshift-lightspeed-tech-preview/lightspeed-console-plugin-rhel9.src as a component of OpenShift Lightspeed; openshift-pipelines/pipelines-console-plugin-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-db-migration-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-ui-rhel8 as a component of OpenShift Pipelines; openshift-service-mesh/kiali-ossmc-rhel8 as a component of OpenShift Service Mesh 2; 3scale-amp-system-container as a component of Red Hat 3scale API Management Platform 2; rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 4; aap-cloud-ui-container as a component of Red Hat Ansible Automation Platform 2; ansible-automation-platform-25/lightspeed-rhel8 as a component of Red Hat Ansible Automation Platform 2; io.apicurio-apicurio-registry as a component of Red Hat build of Apicurio Registry 2; rhcl-console-plugin-container as a component of Red Hat Connectivity Link 1; org.infinispan-infinispan-console as a component of Red Hat Data Grid 8; rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub; grafana as a component of Red Hat Enterprise Linux 10; grafana-selinux as a component of Red Hat Enterprise Linux 10; grafana.src as a component of Red Hat Enterprise Linux 10; thunderbird as a component of Red Hat Enterprise Linux 7; thunderbird.src as a component of Red Hat Enterprise Linux 7; grafana as a component of Red Hat Enterprise Linux 8; and 42 more · Fixed: openshift-gitops-1/argo-rollouts-rhel8@sha256:868a4e993d8963e4fb64c1845f54f916f335d3c59f0596e966c6d926373f6ee1_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:9b883e71b2d12f8872b3a37b383087a488f9b74ddde0e0c6daf6ee04bdf15881_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:bf7f9ca8f33c935df306554b778e5291bcff9e92b7e9122498b0ad71d58b9166_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:ce0677023395a6d7c9598b820c6eb73b651eaa698aef9f5c27a25884fba5d643_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:04523979e4ab58120d959f88503957b1e13122952e3de03d9f0540f1e574c0d6_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:64df9d55e7196fe56ebab88071f115d7fea26fa4396109bbf3bae11ffbf1f3a5_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:9017ef8967ebe3a14ea1e07d0a9624ef126b2928e233f09451aeea89a7f09366_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:ecb181ba7dfd4a5cdffa8ba9ca251dc4875ad7f41e9d60c4cc0a3462c233e489_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:050b358e7512599f412fddf711f8731d821223ba76c460b114fe4c4bfaf7cf1b_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:83ba395adbfdae8d4973cea02ead8392089ac1051edd11e7defc6d07a122bca2_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:dc4d641c87a3b65208ef2b46398f64ae69465daeb84b4d1022062d6c5f7347dc_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:e6eba59c8336bde1ed98947b2d4c626feb2113037bc724bd881f25b7f155f47b_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:065b95a1612d15b3a7de1c5822555851535199711cc3890d56d7cb01e01666b3_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:1c59649ad569e25c3445e9655c8061b7f0b769514c0739f2e080216a55ca39c7_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:490512fefae58c6092394c8e751b7c1761583bff23b815e6f1649d55e9d43002_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:605123efdd9f31243e039929322b4a4f6ad160baaebce188fdbf2c4e7ff663ff_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-operator-bundle@sha256:ba442571ef9180765055f5224548c73e3da2be31731f8dd5b6b1beaf3e6732ee_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:1b81b7c26d7a848797f9944254963a89c3f6f0e727355bafcda5e483fee7b848_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:2caf6bd42e10f063d0991740706946d4205bf49540865bd4ed9091176add2aed_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:951de21fc848014beb5db2f7307ef639c6c76ec6eb7036b18c07047c8a914c48_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:ed04d67b3bd9ebc21a0aa2503823e5a476da44caa165999a33670198f5d1be37_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:72e761f1d00b0a322d4a7a10c824fe88e4ac7e156a279694b75ce3b42be0b6d6_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d20615c230e1b888bacdc374763eeca9b1f7612741f8ba52ded483ac688b858d_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d86dcd96af06a338b577d9c940e6316ed9a807b9fc6a33d9f5c96e2b703679b8_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:f07aa6ccdc324a2631fc01b1f4af4317cdc0471c673bd8f5bf24560e0f012dd9_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:30b687a8309c17d5b4f5be6439b59f2dc540a306d625ee34bdf72626dc36c105_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:62e1ab7267cfd3536c3b2ba9592dffb7fb979cbb039a1a90320a03b751d5f728_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:b5ba9620f23fed74b983a090cec19f6ed74ddffdd1be7d9d89f1201c0c83c1b1_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:c0ec76e307a2867dc1064a3470e17a2e1533233e1a119ce5f32e2b3c07428d08_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/must-gather-rhel8@sha256:a909f1ebb5cf719e4308bbd162fea14e66b0ad6f7e91163699e8f9cbf61ec852_arm64 as a component of Red Hat OpenShift GitOps 1.14; and 925 more
    Red Hat Product Security ↗
Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
Fixed release or patch reference recorded
Fixed release recorded from official guidance
ENISA EUVD · EUVD-2023-2456↗Red Hat Product Security security advisory↗Patch or update reference↗Patch or update reference↗CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2023-44270 · cve.blacktree.nl