CVE-2023-40510 - CVE House
Back to Database
Status published High CVE-2023-40510

LG Simple Editor getServerSetting Authentication Bypass Vulnerability

Vulnerability Description

LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getServerSetting method. The issue results from the exposure of plaintext credentials. An attacker can leverage this vulnerability to bypass authentication on the system. . Was ZDI-CAN-20012.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40510

Credits & Attribution

No credits recorded in the NVD database.

References

More from LG

View All →
CVE-2023-6320
Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
Critical 9.1
CVE-2023-6319
Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
Critical 9.1
CVE-2023-6318
Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
Critical 9.1
CVE-2023-6317
PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction
High 7.2
CVE-2023-41181
LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability
Medium 5.3

Affected Vendor

Affected Software

Simple Editor
Vulnerable Versions:
LG Simple Editor 3.21.0

Timeline

Official Publish: May 3rd, 2024
Last Modified: September 18th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration