CVE-2023-28686 — Authorization Bypass Through User-Controlled Key in Dino
Severity
7.1HIGHNVD
EPSS
0.2%
top 55.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 24
Latest updateApr 9
Description
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NExploitability: 2.8 | Impact: 4.2
Affected Packages2 packages
Also affects: Debian Linux 10.0, 11.0, 12.0, Fedora 36, 37, 38