CVE-2023-6718: 
Python vulnerability analysis and mitigation

An authentication bypass vulnerability (CVE-2023-6718) was discovered in Repox version 2.3.7 and earlier. The vulnerability was disclosed on December 12, 2023, and was discovered by David Cámara Galindo and Andrés Elizalde Galdeano from Telefónica Tech. The vulnerability received a CVSS v3.1 base score of 9.4 (Critical) (INCIBE Advisory).

The vulnerability allows a remote user to send a specially crafted POST request to bypass authentication due to the lack of any authentication method. This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

The successful exploitation of this vulnerability can result in the alteration or creation of users in the Repox system. The vulnerability has high impacts on both confidentiality and integrity, with a lower impact on system availability (INCIBE Advisory).

As of the vulnerability disclosure, no official solution or mitigation has been reported (INCIBE Advisory).