CVE-2023-5830: ColumbiaSoft Document Locator WebTools login improper authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, and a high EPSS score (0.60782) indicate severe risk and likely active exploitation.

What it is

CVE-2023-5830 is a critical improper authentication flaw (CWE-287) in ColumbiaSoft Document Locator's WebTools component, specifically the /api/authentication/login endpoint. Manipulating the Server argument allows an attacker to bypass authentication. The vendor addressed it in version 7.2 SP4 and 2021.1.

Impact

An unauthenticated remote attacker can bypass authentication on the login API, potentially gaining access to the application with the privileges of the impersonated or default account. Given the CVSS vector (C:H/I:H/A:H), full compromise of confidentiality, integrity, and availability is possible.

Attack surface

Reachable over the network via the /api/authentication/login endpoint of the WebTools component; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS probability is 0.60782 (99.1st percentile), indicating a high likelihood of exploitation activity in the wild.

What to do

• Upgrade Document Locator to version 7.2 SP4 or 2021.1 as recommended by the vendor.
• If immediate upgrade is not possible, restrict network access to the /api/authentication/login endpoint to trusted networks or IP ranges.
• Monitor and log authentication attempts to the WebTools API for anomalous Server argument values.
• Apply network segmentation to limit exposure of the WebTools component to the internet.

Detection

• Inspect web server and application logs for requests to /api/authentication/login with unusual or unexpected Server parameter values.
• Alert on successful authentication events originating from untrusted or unexpected source IPs.
• Correlate multiple failed login attempts followed by a successful login from the same source within a short window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.