CVE-2023-4168 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Templatecookie Adlisting v2.14.0 leaks sensitive data in redirect responses. 💥 **Consequences**: API keys, server keys, and App IDs are exposed in the HTTP body. Critical info security breach! 📉

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-200 (Information Exposure). 🔍 **Flaw**: The application fails to sanitize redirect responses, leaking internal secrets directly to the client side. 🐛

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Templatecookie. 📦 **Product**: Adlisting. 📅 **Version**: Specifically **v2.14.0**. ⚠️ Check your deployment versions immediately! 🕵️♂️

Q: What can hackers do? (Privileges/Data)

💻 **Hackers Can**: Extract sensitive credentials (API keys, Server keys, App IDs). 🗝️ **Impact**: These keys can be used to access third-party services or compromise server integrity. 📉

Q: Is exploitation threshold high? (Auth/Config)

🔐 **Auth Required**: Yes. CVSS vector shows **PR:L** (Privileges Required: Low). 🚶 **Access**: Normal users can trigger this by accessing any page. No complex setup needed. 🚪

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Available**: Yes! Public PoC exists via Nuclei templates. 🌐 **Link**: `projectdiscovery/nuclei-templates`. 📢 Wild exploitation is possible for those with basic scanning tools. 🚀

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Use Nuclei with the specific CVE template. 🧪 **Method**: Access any page on the target site and inspect the redirect response body for leaked keys. 📝

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Status**: No official patch mentioned in the data. 📢 **Advice**: Monitor CNNVD or vendor announcements for updates. 📅 Stay tuned! 👀

Q: What if no patch? (Workaround)

🚧 **Workaround**: If no patch, restrict access to the application. 🛑 Implement WAF rules to block suspicious redirect patterns. 🛡️ Limit exposure until fixed. 🏗️

Q: Is it urgent? (Priority Suggestion)

⚡ **Priority**: HIGH. 🚨 **Reason**: Low exploitation threshold + High value data (API keys) exposed. 📉 Immediate action required to prevent credential theft. 🔥

Updated May 08, 2026 CVSS 4.3 · Medium

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Templatecookie Adlisting v2.14.0 leaks sensitive data in redirect responses. 💥 **Consequences**: API keys, server keys, and App IDs are exposed in the HTTP body. Critical info security breach! 📉

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-200 (Information Exposure). 🔍 **Flaw**: The application fails to sanitize redirect responses, leaking internal secrets directly to the client side. 🐛

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Templatecookie. 📦 **Product**: Adlisting. 📅 **Version**: Specifically **v2.14.0**. ⚠️ Check your deployment versions immediately! 🕵️‍♂️

Q4What can hackers do? (Privileges/Data)

💻 **Hackers Can**: Extract sensitive credentials (API keys, Server keys, App IDs). 🗝️ **Impact**: These keys can be used to access third-party services or compromise server integrity. 📉

Q5Is exploitation threshold high? (Auth/Config)

🔐 **Auth Required**: Yes. CVSS vector shows **PR:L** (Privileges Required: Low). 🚶 **Access**: Normal users can trigger this by accessing any page. No complex setup needed. 🚪

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Available**: Yes! Public PoC exists via Nuclei templates. 🌐 **Link**: `projectdiscovery/nuclei-templates`. 📢 Wild exploitation is possible for those with basic scanning tools. 🚀

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Use Nuclei with the specific CVE template. 🧪 **Method**: Access any page on the target site and inspect the redirect response body for leaked keys. 📝

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Status**: No official patch mentioned in the data. 📢 **Advice**: Monitor CNNVD or vendor announcements for updates. 📅 Stay tuned! 👀

Q9What if no patch? (Workaround)

🚧 **Workaround**: If no patch, restrict access to the application. 🛑 Implement WAF rules to block suspicious redirect patterns. 🛡️ Limit exposure until fixed. 🏗️

Q10Is it urgent? (Priority Suggestion)

⚡ **Priority**: HIGH. 🚨 **Reason**: Low exploitation threshold + High value data (API keys) exposed. 📉 Immediate action required to prevent credential theft. 🔥

Continue exploring

Vulnerability detail Full AI analysis (login) Templatecookie CWE-200