Security Resilience

CVE-2023-40673

Published
04 June 2024
Modified
15 April 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0040 32th percentile
Risk Priority 51 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-40673 is a medium-severity Improper Control of Interaction Frequency (CWE-799) vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.

CWE(s)
CWE-799

Related Threats

CVEs Like This One

CVE-2026-7402Shared CWE-799
CVE-2023-38068Shared CWE-799
CVE-2024-48942Shared CWE-799
CVE-2024-0094Shared CWE-799
CVE-2025-52880Shared CWE-799
CVE-2026-100603Shared CWE-799
CVE-2024-32943Shared CWE-799
CVE-2025-55268Shared CWE-799
CVE-2024-47065Shared CWE-799
CVE-2023-35621Shared CWE-799

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-10 Concurrent Session Control good match

ac-10 enforces a hard limit on concurrent sessions per user, directly stopping uncontrolled interaction frequency at the session level.

AC-7 Unsuccessful Logon Attempts good match

ac-7 directly enforces a limit on the frequency of invalid authentication attempts, structurally preventing the weakness for that interaction class.

SC-5 Denial-of-service Protection partial match

sc-5 reduces the impact of excessive request volume (DoS) but does not itself impose the frequency controls whose absence defines the weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly include controls on interaction frequency and throttling.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles recommend rate-limiting and resource-management mechanisms.

A.8.28 Secure coding partial match
prevents

Secure coding practices can embed input-frequency and throttling checks in code.

A.8.6 Capacity management partial match
degrades

Capacity management directly limits request rates and resource exhaustion that CWE-799 describes.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-799, a class-level weakness. Rules are authored against its narrower children: CWE-307.

References