CVE-2023-38315

Name of the Vulnerable Software and Affected Versions OpenNDS Captive Portal versions prior to 10.1.2

Description An issue in OpenNDS Captive Portal can be triggered with a crafted GET HTTP request that has a missing client token query string parameter, resulting in a NULL pointer dereference in the try to authenticate function. This can cause OpenNDS to crash, leading to a Denial-of-Service condition.

Recommendations For OpenNDS Captive Portal versions prior to 10.1.2, update to version 10.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoint until the update is applied.