CVE-2023-1537

CRITICAL

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS0.8%
Percentile57th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-294: CWE-294
Related Attack Patterns (CAPEC)
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-294
CAPEC-102 Session Sidejacking
via CWE-294
CAPEC-509 Kerberoasting
via CWE-294
CAPEC-561 Windows Admin Shares with Stolen Credentials
via CWE-294
CAPEC-644 Use of Captured Hashes (Pass The Hash)
via CWE-294
Show all 10

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in the GitHub repository answerdev/answer prior to version 1.0.6 allows attackers to perform an authentication bypass via capture-replay attacks, potentially gaining unauthorized access to the system.

BSID: BS-2023-GLOBAL-325857-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-1537?
A critical vulnerability in the GitHub repository answerdev/answer prior to version 1.0.6 allows attackers to perform an authentication bypass via capture-replay attacks, potentially gaining unauthorized access to the system.
What is the CVSS score for CVE-2023-1537?
CVE-2023-1537 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2023-1537 actively exploited?
No confirmed active exploitation of CVE-2023-1537 as of 2026-05-30.
How do I remediate CVE-2023-1537?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-1537?
CVE-2023-1537 affects Answer Answer.
Vulnerability Details
CVE IDCVE-2023-1537
BSIDBS-2023-GLOBAL-325857-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-03-21
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-294
SourceNVD
Official Description

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from the lack of proper validation of authentication tokens or session identifiers, enabling attackers to intercept and replay valid authentication requests to gain unauthorized access.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Answer Answer < 1.0.6
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1305 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash6fc53f34a2d3b15898e8ff456a67038d8bac7e88dd5112ed0372727b349664b569949ff9da8a1ad9dd1fb19bc88c98261f38bc319931b7b7467a717f2816e39d
Related CVEs affecting Answer
CVE-2023-0744 9.8 Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. CVE-2026-4365 9.1 The LearnPress plugin for WordPress is vulnerable to unauthorized data deleti... CVE-2023-0741 9.0 Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior ... CVE-2023-0743 9.0 Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer pr... CVE-2023-0742 9.0 Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer pri...
View all Answer CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →