Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-26261 Details

Description

In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://documentation.ubikasec.com/x/CQDAAw CVEProduct
https://gist.github.com/Jakick/7d1635b886654ddd0e476b3c79a7ba9f CVEThird Party Advisory
https://documentation.ubikasec.com/x/CQDAAw [email protected]Product
https://gist.github.com/Jakick/7d1635b886654ddd0e476b3c79a7ba9f [email protected]Third Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')[email protected]
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CISA-ADP

Affected Products

ProductVersions
ubikasec waap cloud
< 6.11.0
< 6.5.6
6.5.6 -

CPE

  • cpe:2.3:a:ubikasec:waap_cloud:*:*:*:*:*:*:*:*
  • cpe:2.3:a:ubikasec:waap_cloud:6.5.6:-:*:*:*:*:*:*

Remediation

  • No remediation found in references.
ubikasec waap gateway
< 6.11.0
< 6.5.6
6.5.6 -

CPE

  • cpe:2.3:a:ubikasec:waap_gateway:*:*:*:*:*:*:*:*
  • cpe:2.3:a:ubikasec:waap_gateway:6.5.6:-:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-26261
NVD Published Date:
Mar 8, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-26261 Details - Not Deferred