CVE-2023-6676

HIGH

Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery. This issue affects CyberMath: from v1.4 before v1.5.

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.3%
Percentile20th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-352: Cross-Site Request Forgery (CSRF)

Web application does not verify that a request was intentionally sent by the authenticated user.

Related Attack Patterns (CAPEC)
CAPEC-462 Cross-Domain Search Timing
via CWE-352
CAPEC-467 Cross Site Identification
via CWE-352
CAPEC-62 Cross Site Request Forgery
via CWE-352
CAPEC-111 JSON Hijacking (aka JavaScript Hijacking)
via CWE-352

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A Cross-Site Request Forgery (CSRF) vulnerability exists in National Keep Cyber Security Services CyberMath, affecting versions from v1.4 before v1.5. This vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user.

BSID: BS-2024-GLOBAL-179036-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-6676?
A Cross-Site Request Forgery (CSRF) vulnerability exists in National Keep Cyber Security Services CyberMath, affecting versions from v1.4 before v1.5. This vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user.
What is the CVSS score for CVE-2023-6676?
CVE-2023-6676 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 0.3%.
Is CVE-2023-6676 actively exploited?
No confirmed active exploitation of CVE-2023-6676 as of 2026-05-30.
How do I remediate CVE-2023-6676?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-6676?
CVE-2023-6676 affects Nationalkeep Cybermath.
Vulnerability Details
CVE IDCVE-2023-6676
BSIDBS-2024-GLOBAL-179036-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2024-02-02
Last Modified2026-05-20
ICS Relevance0%
Weakness (CWE)
Cross-Site Request Forgery (CSRF)
SourceNVD
Official Description

Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery. This issue affects CyberMath: from v1.4 before v1.5.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves an attacker tricking a user into clicking a malicious link or visiting a malicious website while they are authenticated to the CyberMath application. The attacker can then force the user's browser to execute unwanted actions, such as changing settings or performing transactions, without the user's consent.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Nationalkeep Cybermath 1.4
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 986 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash7ec48138309af2f5e0d5fbc3e502308b6de1f074b194ad3610c7367072096d51c7ee5f2cea0dda7fbe59add0e0b2ac77e6f85f6df4e7c740a76d52dc03a788a6
Related CVEs affecting Nationalkeep
CVE-2023-6675 9.8 Unrestricted Upload of File with Dangerous Type vulnerability in National Kee... CVE-2024-7108 9.8 Incorrect Authorization vulnerability in National Keep Cyber Security Service... CVE-2024-7107 7.5 Files or Directories Accessible to External Parties vulnerability in National... CVE-2023-6673 6.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2023-6672 5.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri...
View all Nationalkeep CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →