How severe is CVE-2023-5296?

CVE-2023-5296 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2023-5296 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-5296?

CVE-2023-5296 primarily affects Rockoa. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-5296?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-5296 published?

CVE-2023-5296 was published on 2023-09-29 and last updated on 2026-06-17.

CVE-2023-5296

CVE-2023-5296 is a medium-severity vulnerability in Rockoa with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-640.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v2: 4.0
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-640
Affected product: Rockoa
Published: 2023-09-29
Last modified: 2026-06-17

Description

A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240926 is the identifier assigned to this vulnerability.

Frequently asked questions

What is CVE-2023-5296?: A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240926 is the identifier assigned to this vulnerability.
How severe is CVE-2023-5296?: CVE-2023-5296 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2023-5296 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-5296?: CVE-2023-5296 primarily affects Rockoa. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-5296?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-5296 published?: CVE-2023-5296 was published on 2023-09-29 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:rockoa:rockoa:1.1:*:*:*:*:*:*:*
cpe:2.3:a:rockoa:rockoa:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:rockoa:rockoa:15.x3amdi:*:*:*:*:*:*:*

More vulnerabilities in Rockoa

CVE-2025-63742 — Critical (CVSS 9.8): SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA…
CVE-2023-49363 — Critical (CVSS 9.8): Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.
CVE-2020-18716 — Critical (CVSS 9.8): SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in…
CVE-2020-18714 — Critical (CVSS 9.8): SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in…
CVE-2020-18713 — Critical (CVSS 9.8): SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in…
CVE-2019-9846 — High (CVSS 8.8): RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php…

All CVEs affecting Rockoa →

Other CWE-640 vulnerabilities

CVE-2025-63314 — Critical (CVSS 10.0): A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to…
CVE-2023-7028 — Critical (CVSS 10.0): An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9,…
CVE-2026-13019 — Critical (CVSS 9.8): Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for…
CVE-2026-37106 — Critical (CVSS 9.8): An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register…
CVE-2026-12417 — Critical (CVSS 9.8): The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation…
CVE-2026-12416 — Critical (CVSS 9.8): The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to,…

Browse all CWE-640 vulnerabilities →