CVE-2023-52353
HIGHDescription
An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum.
Is your site exposed to CVE-2023-52353?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| arm | mbed_tls |
References
Frequently Asked Questions
What is CVE-2023-52353? +
How severe is CVE-2023-52353? +
What products are affected by CVE-2023-52353? +
How do I check if I'm vulnerable to CVE-2023-52353? +
Related Vulnerabilities
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of …
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially …
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to …
KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with …
tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's …
Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from …