CVE-2023-2968
Proxy Project Proxy 2.0.0 … 2.1.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-2968 is a high-severity Improper Handling of Undefined Values (CWE-232) vulnerability in Proxy Project Proxy. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 28% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1582
Vulnerability Data
A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and error handling for undefined values.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing handling of undefined values before release.
Secure development life cycle requires handling of invalid/undefined inputs during design and coding.
Application security requirements include validation of all parameters and handling of unsupported values.
Secure architecture principles mandate explicit handling of undefined or unsupported states.
Secure coding standards directly require defensive checks for undefined or unsupported parameter values.