CVE-2023-4168: Templatecookie Adlisting Redirect Handler information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network, unauthenticated, no-interaction access and a public exploit plus high EPSS make this a high-priority exposure despite the thin technical detail.

What it is

Templatecookie Adlisting 2.14.0 contains an information disclosure flaw in the Redirect Handler component, reachable through the /ad-list file. The affected function is not identified in the record, and the vendor did not respond to the disclosure. Because the flaw exposes data without authentication, it matters to any site running this classified-ads product.

Impact

An unauthenticated attacker can read information the application is not intended to expose. The record does not specify which data is leaked, so the exact sensitivity is unknown.

Attack surface

The vector is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so the /ad-list endpoint can be hit directly over HTTP. No authentication is required.

Exploitation

A public exploit exists per the Packet Storm reference, and EPSS is 0.45972 (98.75th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is documented.

What to do

• Apply the vendor fix if one becomes available; the vendor did not respond to the disclosure, so confirm patch status directly before relying on it.
• If no patch exists, restrict or block external access to the /ad-list endpoint and the Redirect Handler until the issue is resolved.
• Place the application behind a WAF or reverse proxy rule that filters requests targeting the vulnerable redirect path.
• Review server and application logs for unexpected access to /ad-list and treat anomalous responses as potential data exposure.
• Plan migration or replacement if the vendor remains unresponsive and no fix is issued.

Detection

• Monitor web logs for requests to /ad-list, especially from unauthenticated clients or unusual source IPs.
• Alert on response sizes or patterns from the Redirect Handler that differ from normal behavior.
• Correlate access to /ad-list with subsequent scanning or enumeration activity from the same source.
• Use the public Packet Storm exploit details to build a signature for the specific request pattern.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.