CVE-2023-0744

CRITICAL ⚠ Exploit

Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS6.4%
Percentile94th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-284: Improper Access Control

Software does not restrict or incorrectly restricts access to a resource.

Related Attack Patterns (CAPEC)
CAPEC-478 Modification of Windows Service Configuration
via CWE-284
CAPEC-479 Malicious Root Certificate
via CWE-284
CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment
via CWE-284
CAPEC-550 Install New Service
via CWE-284
CAPEC-551 Modify Existing Service
via CWE-284
Show all 17

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Improper Access Control vulnerability in GitHub repository answerdev/answer prior to version 1.0.4 allows unauthorized users to access sensitive data or perform actions they should not be able to.

BSID: BS-2023-GLOBAL-297981-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-0744?
Improper Access Control vulnerability in GitHub repository answerdev/answer prior to version 1.0.4 allows unauthorized users to access sensitive data or perform actions they should not be able to.
What is the CVSS score for CVE-2023-0744?
CVE-2023-0744 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 6.4%.
Is CVE-2023-0744 actively exploited?
Public exploit available for CVE-2023-0744. Exploitation risk elevated.
How do I remediate CVE-2023-0744?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-0744?
CVE-2023-0744 affects Answer Answer.
Vulnerability Details
CVE IDCVE-2023-0744
BSIDBS-2023-GLOBAL-297981-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-02-08
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Improper Access Control
SourceNVD
Official Description

Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending specially crafted requests to the affected application, potentially leading to unauthorized access to user data, configuration files, or the ability to execute arbitrary code.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Answer Answer < 1.0.4
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1346 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Answer
CVE-2023-1537 9.8 Authentication Bypass by Capture-replay in GitHub repository answerdev/answer... CVE-2026-4365 9.1 The LearnPress plugin for WordPress is vulnerable to unauthorized data deleti... CVE-2023-0741 9.0 Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior ... CVE-2023-0743 9.0 Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer pr... CVE-2023-0742 9.0 Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer pri...
View all Answer CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →