CVE-2023-23691
Possible ATT&CK Techniques 2AI
T1189 · Drive-by Compromise T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-23691
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5
Vulnerability Title
Dell MEC PV ME5 环境问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dell MEC PV ME5是美国戴尔（Dell）公司的一款专为价格敏感的 SAN 和 DAS 环境构建和优化的入门级块存储阵列。 Dell EMC PV ME5.1.0.0.0版本和ME5.1.0.1.0版本存在安全漏洞。攻击者利用该漏洞迫使受害者的浏览器取消与网站的连接同步，从而导致跨站脚本和拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Dell | Dell PowerVault ME5 | 0 ~ ME5.1.1.0.5 | - |
II. Public POCs for CVE-2023-23691
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-23691
请登录查看更多情报信息。
Other References for CVE-2023-23691 (1)
IV. Related Vulnerabilities
Same weakness: CWE-444
- CVE-2026-63385
Libevent: HTTP header handling bugs create risk of access co - CVE-2026-63379
Libevent: HTTP Header smuggling - CVE-2026-63382
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Sm - CVE-2026-73256
Mongoose: HTTP/1.0 detection off-by-one enables request smug - CVE-2026-73257
Mongoose: Content-Length + Transfer-Encoding coexistence ena
V. Comments for CVE-2023-23691
No comments yet