CVE-2023-2882— Privilege Escalation in CBOT's Chatbot
Quick assessment
Affected
CBOT Chatbot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CBOT Chatbot是CBOT公司的一个人工智能驱动的实时聊天解决方案。 CBOT Chatbot Core v4.0.3.4 之前版本、 Panel v4.0.3.7之前版本存在安全漏洞，该漏洞源于生成不正确的安全令牌，允许令牌模拟、特权滥用。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-2882
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Privilege Escalation in CBOT's Chatbot
Source: CVE Program / CVE List V5
Vulnerability Description
Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.
This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1270
Source: CVE Program / CVE List V5
Vulnerability Title
CBOT Chatbot 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CBOT Chatbot是CBOT公司的一个人工智能驱动的实时聊天解决方案。 CBOT Chatbot Core v4.0.3.4 之前版本、 Panel v4.0.3.7之前版本存在安全漏洞，该漏洞源于生成不正确的安全令牌，允许令牌模拟、特权滥用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-2882
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-2882
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-2882 (1)
-
🔗 T.C. Siber Güvenlik Başkanlığı - Güvenlik Bildirimleri Detay government-resource
Other References for CVE-2023-2882 (1)
-
https://www.usom.gov.tr/bildirim/tr-23-0293 government-resource
Same Patch Batch · CBOT · 2023-05-25 · 6 CVEs total
| CVE-2023-2887 | 9.8 CRITICAL | User Authentication Bypass in CBOT's Chatbot |
| CVE-2023-2884 | 9.8 CRITICAL | Insecure Randomness in CBOT's Chatbot |
| CVE-2023-2883 | 8.8 HIGH | IDOR in CBOT's Chatbot |
| CVE-2023-2885 | 8.1 HIGH | Channel Accessible by Non-Endpoint in CBOT's Chatbot |
| CVE-2023-2886 | 4.3 MEDIUM | Cross-Site WebSocket Hijacking in CBOT's Chatbot |
IV. Related Vulnerabilities
Same product: Chatbot
-
CVE-2026-57363
WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XS -
CVE-2026-57362
WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scr -
CVE-2026-40788
WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vu -
CVE-2026-32499
WordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerabil -
CVE-2025-64277
WordPress ChatBot plugin <= 7.3.9 - Broken Access Control vu
Same weakness: CWE-1270
-
CVE-2026-19636
Insuffucient Protections Lead to Brute Force -
CVE-2026-15831
Generation of Incorrect Security Tokens in GitLab -
CVE-2026-49499
Dell PowerProtect Data Manager 授权问题漏洞 -
CVE-2023-32188
JWT token compromise can allow malicious actions including R -
CVE-2023-22644
JWT token compromise can allow malicious actions including R
V. Comments for CVE-2023-2882
No comments yet