UpHeron
All vulnerabilities

Servers and applications

CVE-2023-38492

Denial of service from unlimited password lengths

Severity
High 7.5
Published
27 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
Also known as
GHSA-3v6j-v3qc-cxff
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities.…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 3.5.0 before 3.5.8.3
  • From 3.6.0 before 3.6.6.3
  • From 3.7.0 before 3.7.5.2
  • From 3.8.0 before 3.8.4.1
  • From 3.9.0 before 3.9.6
KirbyServers and applications · github:getkirby/kirby
  • From 3.9.0 before 3.9.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38492
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-38492
  • GitHub Advisory Database https://github.com/advisories/GHSA-3v6j-v3qc-cxff
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-3v6j-v3qc-cxff