What is CVE-2023-1663?

CVE-2023-1663 is a medium-severity vulnerability in Synopsys Coverity, classified under Direct Request (Forced Browsing). CVSS score: 6.5/10. Published 2023-03-29.

How severe is CVE-2023-1663?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Synopsys Coverity

CVE-2023-1663

Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a result, the downloads directory and its contents are accessible. 5.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C)

EPSS: 0.004 (35.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.

Affected products

Synopsys Coverity — versions 0

Weakness classification (CWE)

CWE-425 — Direct Request (Forced Browsing)

References

disclosure@synopsys.com (vendor-advisory, Vendor Advisory)
disclosure@synopsys.com (Permissions Required, mitigation)

Frequently asked questions

What is CVE-2023-1663?: CVE-2023-1663 is a medium-severity vulnerability in Synopsys Coverity, classified under Direct Request (Forced Browsing). CVSS score: 6.5/10. Published 2023-03-29.
How severe is CVE-2023-1663?: Medium severity. CVSS v3 base score is 6.5 out of 10.