CBOT vulnerabilities

Products

• cbot core 6
• cbot panel 6
• Chatbot 6

Latest CBOT CVEs

Newest publication first

1. CVE-2023-2887 User Authentication Bypass in CBOT's Chatbot

   Published 2023-05-25

   Critical·CVSS 9.8

   Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

2. CVE-2023-2886 Cross-Site WebSocket Hijacking in CBOT's Chatbot

   Published 2023-05-25

   Medium·CVSS 4.3

   Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

3. CVE-2023-2885 Channel Accessible by Non-Endpoint in CBOT's Chatbot

   Published 2023-05-25

   High·CVSS 8.1

   Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

4. CVE-2023-2884 Insecure Randomness in CBOT's Chatbot

   Published 2023-05-25

   Critical·CVSS 9.8

   Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

5. CVE-2023-2883 IDOR in CBOT's Chatbot

   Published 2023-05-25

   High·CVSS 8.8

   Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

6. CVE-2023-2882 Privilege Escalation in CBOT's Chatbot

   Published 2023-05-25

   Critical·CVSS 9.8

   Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.