Is CVE-2023-4709 actively exploited?

No active exploitation of CVE-2023-4709 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-4709 be exploited remotely?

Yes. CVE-2023-4709 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-4709?

CVE-2023-4709 has a CVSS score of 3.1 (LOW).

HOME VULNERABILITIESCVE-2023-4709

LOW

CVE-2023-4709

CWE-79Published: September 1, 2023· Updated: Jun 17, 2026

3.1

CVSS v3.1

Official Description

A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. It is possible to mitigate the problem by applying the configuration setting <pages validateRequest="true" [...] viewStateEncryptionMode="Always" />. It is recommended to change the configuration settings. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation."

NVD Source

Technical Analysis

CVE-2023-4709 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.