CVE-2023-2665
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
- Record
CVE-2023-2665- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-921
- Updated
- 2026-11-02
EUVDEUVD-2023-1456
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
- Record
EUVD-2023-1456- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36cm-h8gv-mg97
RosarioSIS Stores Sensitive Data in a Mechanism without Access Control
RosarioSIS prior to 11.0 allows anyone, regardless of authentication status, to download and view file attachments under the salaries module. In addition, the file names contain a date in a YYYY-MM-DD format and a random six-string digit, making enumerating file names with automated tools relatively easy. This could allow an attacker to gain access to sensitive salary information. The patch for version 11.0 adds microseconds to filenames to make them harder to guess.
- Record
GHSA-36cm-h8gv-mg97- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-921, CWE-922
- Updated
- 2026-11-02
NVD
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
- Record
CVE-2023-2665- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-921, CWE-922
- Updated
- 2026-11-02
OSV
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
- Record
CVE-2023-2665- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-921
- Updated
- 2026-11-02
OSVGHSA-36cm-h8gv-mg97
RosarioSIS Stores Sensitive Data in a Mechanism without Access Control
RosarioSIS prior to 11.0 allows anyone, regardless of authentication status, to download and view file attachments under the salaries module. In addition, the file names contain a date in a YYYY-MM-DD format and a random six-string digit, making enumerating file names with automated tools relatively easy. This could allow an attacker to gain access to sensitive salary information. The patch for version 11.0 adds microseconds to filenames to make them harder to guess.
- Record
GHSA-36cm-h8gv-mg97- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-921, CWE-922
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
francoisjacquet/rosariosisPackagist |
before 11.0 | 11.0 |
francoisjacquet/rosariosisPackagist |
before 11.0, plus listed versions v10.1v10.2v10.2.1v10.2.2v10.2.3 Show 45 moreShow lessv10.3v10.3.1v10.3.2v10.3.3v10.4v10.4.1v10.4.2v10.4.3v10.4.4v10.5v10.5.1v10.5.2v10.6v10.6.1v10.6.2v10.6.3v10.7v10.7.1v10.8v10.8.1v10.8.2v10.8.3v10.8.4v10.8.5v10.9v10.9.1v10.9.2v10.9.3v10.9.4v10.9.5v10.9.6v10.9.7v10.9.8v5.0v5.0-beta3v5.0-beta4v5.0.1v5.0.2v5.0.3v5.0.4v5.0.5v5.1v5.1-betav5.1.1v5.2 |
11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2665 is a high vulnerability (CVSS 7.5) in Francoisjacquet Francoisjacquet/rosariosis, published May 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in francoisjacquet/rosariosis 11.0.
References
huntr.dev/bounties/42f38a84-8954-484d-b5ff-706ca0918194
github.com/francoisjacquet/rosariosis/commit/09d5afaa6be07688ca1a7ac3b755b5438109e986
nvd.nist.gov/vuln/detail/CVE-2023-2665
Left out here: 148 versions. The JSON record has them.