Security Resilience

CVE-2023-1976

Answer ≤ 1.0.6

Public PoC
Published
11 April 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0061 48th percentile
Risk Priority 65 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-1976 is a high-severity Password Aging with Long Expiration (CWE-263) vulnerability in Answer Answer. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.

CWE(s)
CWE-263

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1012 Query Registry Discovery
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
attack.mitre.org →
T1020.001 Traffic Duplication Exfiltration
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.
attack.mitre.org →
T1021 Remote Services Lateral Movement
Adversaries may use [Valid Accounts](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-4125Same product: Answer Answer
CVE-2023-1537Same product: Answer Answer
CVE-2023-1539Same product: Answer Answer
CVE-2023-1540Same product: Answer Answer
CVE-2023-1538Same product: Answer Answer
CVE-2023-4815Same product: Answer Answer
CVE-2023-0744Same product: Answer Answer
CVE-2023-1240Same product: Answer Answer
CVE-2023-1243Same product: Answer Answer
CVE-2023-0741Same product: Answer Answer

Affected Assets

answer
answer
≤ 1.0.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.4.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-01 partial match
blocks

Credential management includes setting and enforcing password lifetime rules.

PR.AA-03 partial match
blocks

Password policy enforcement can directly specify maximum password age.

PR.PS-01 partial match
blocks

Hardened baselines commonly embed password-aging configuration settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information partial match
degrades

Requires policies for managing authentication credentials including password lifetime.

A.7.12 Cabling security partial match
removes
A.8.19 Installation of software on operational systems partial match
removes
A.8.26 Application security requirements partial match
removes

A.8.26 only requires that password aging requirements be identified and specified during development or acquisition; it never mandates, designs, or applies a short expiration period that would make the long-expiration flaw stop being present in the delivered product

A.8.27 Secure system architecture and engineering principles partial match
removes

A.8.27 mandates establishing and applying secure engineering principles (including least privilege, security by design, hardening) during the SDLC; it does not mandate or perform the concrete removal of an already-written long password-expiration value from product code

A.8.5 Secure authentication partial match
degrades

Mandates secure authentication mechanisms that include appropriate password expiration settings.

References