{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T05:16:47.213","vulnerabilities":[{"cve":{"id":"CVE-2023-6578","sourceIdentifier":"cna@vuldb.com","published":"2023-12-07T21:15:08.863","lastModified":"2026-06-17T06:51:01.643","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup may request username and password. By just clicking CANCEL you will be redirected to the directory. If you visited /invoke/wm.server/connect, you'll be able to see details like internal IPs, ports, and versions. In some cases if access to /assets/ is refused, you may enter /assets/x as a wrong value, then come back to /assets/ which we will show the requested data. It appears that insufficient access control is depending on referrer header data. VDB-247158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"es","value":"Una vulnerabilidad ha sido encontrada en Software AG WebMethods 10.11.x/10.15.x y clasificada como crítica. Una función desconocida del archivo wm.server/connect/ es afectada por esta vulnerabilidad. La manipulación conduce a controles de acceso inadecuados. Es posible lanzar el ataque de forma remota. Para acceder a un archivo como /assets/, una ventana emergente puede solicitar un nombre de usuario y contraseña. Con solo hacer clic en CANCELAR será redirigido al directorio. Si visitó /invoke/wm.server/connect, podrá ver detalles como IP internas, puertos y versiones. En algunos casos, si se rechaza el acceso a /assets/, puede ingresar /assets/x como un valor incorrecto y luego regresar a /assets/ donde mostraremos los datos solicitados. Parece que el control de acceso insuficiente depende de los datos del encabezado de referencia. VDB-247158 es el identificador asignado a esta vulnerabilidad. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Software AG","product":"WebMethods","versions":[{"version":"10.11.x","status":"affected"},{"version":"10.15.x","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:softwareag:webmethods:*:*:*:*:*:*:*:*","versionStartIncluding":"10.11","versionEndIncluding":"10.11.4","matchCriteriaId":"AC610CE6-5942-4AB8-A91F-D50098BDBC31"},{"vulnerable":true,"criteria":"cpe:2.3:a:softwareag:webmethods:*:*:*:*:*:*:*:*","versionStartIncluding":"10.15","versionEndIncluding":"10.15.4","matchCriteriaId":"943EE677-BF5F-4376-AC45-4C7582076C18"}]}]}],"references":[{"url":"https://vuldb.com/?ctiid.247158","source":"cna@vuldb.com","tags":["Permissions Required","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?id.247158","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.247158","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?id.247158","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]}]}}]}