Cyber Posture

CVE-2023-4815

HighPublic PoC

Published: 07 September 2023

Published
07 September 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 18.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-4815 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Answer Answer. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: AI Model Inference API Access (AML.T0040), LLM Prompt Injection (AML.T0051), Manipulate AI Model (AML.T0018).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). AI-specific risk: MITRE ATLAS AI Model Inference API Access (AML.T0040) plus 6 more.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306

Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.

addresses: CWE-306

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

addresses: CWE-306

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

addresses: CWE-306

Guarantees critical functions are protected by mandatory invocation of the access control mechanism.

addresses: CWE-306

Auditing sessions makes it possible to detect access to critical functions without required authentication.

addresses: CWE-306

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

addresses: CWE-306

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-306

Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authentication for a critical function in the public-facing web application (Answer prior to v1.1.3) enables adversaries to exploit the application without credentials for initial access.

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0040: AI Model Inference API AccessAML.T0051: LLM Prompt InjectionAML.T0018: Manipulate AI ModelAML.T0024: Exfiltration via AI Inference APIAML.T0048: External HarmsAML.T0010: AI Supply Chain CompromiseAML.T0016: Obtain Capabilities

NVD Description

Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)

Affected Products

answer
answer
≤ 1.1.3

AI Security AnalysisAI

AI Category
Enterprise AI Assistants
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
The GitHub repository answerdev/answer is an open-source AI knowledge base and Q&A platform powered by LLMs, fitting the Enterprise AI Assistants category. The vulnerability was reported on huntr.dev, a bug bounty platform for AI/ML, confirming its AI relevance.

CVEs Like This One

CVE-2026-1453Shared CWE-306
CVE-2026-31882Shared CWE-306
CVE-2019-25240Shared CWE-306
CVE-2025-27642Shared CWE-306
CVE-2021-47891Shared CWE-306
CVE-2026-26340Shared CWE-306
CVE-2025-3498Shared CWE-306
CVE-2025-52665Shared CWE-306
CVE-2024-6842Shared CWE-306
CVE-2025-0355Shared CWE-306

References