CVE-2023-4560
Omeka S ≤ 4.0.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2023-4560 is a medium-severity Improper Authorization of Index Containing Sensitive Information (CWE-612) vulnerability in Omeka Omeka S. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54415
Vulnerability Data
Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces authorization policy and least privilege for access to sensitive data including indexes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction is the technical mechanism that prevents unauthorized index queries.
Managing access rights ensures only authorized users can reach indexed sensitive content.
Privileged access rights may be used to enforce index restrictions but are not the primary control.
Classification helps identify what must be protected but does not enforce index access limits.
Access control policies directly limit who can query or view the index.
Data leakage prevention can block unauthorized index exposure but is supplementary.