CVE-2023-38492

Summary

CVE-2023-38492 is a vulnerability in the Kirby content management system affecting versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. This issue allows attackers to provide excessively long passwords at the authentication endpoint, potentially causing websites to become unresponsive or unavailable due to the increased processing requirements. The impact is limited as Kirby includes a built-in brute force protection allowing only 10 failed logins per IP and hour per user. The vulnerability has been addressed with password length limits in the patch releases 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. It is recommended to update to these versions to mitigate the vulnerability as well as other security issues.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.