Henschen & Associates court document management software cache uses predictable file names

published 2023-11-30 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58617

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents.

Patch / fix

fixed in 1

Henschen & Associates court document management software ~2023-11-22

Exploit prediction

1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/qwell/disorder-in-the-court/blob/main/README-Henschen%26Associates.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Henschen & Associates court document management software

Classification

Weakness

CWE-330 Use of Insufficiently Random Values

References

github.com /qwell/disorder-in-the-court/blob/main/README-Henschen%26Associates.md
exploit, third-party-advisory
henschen.com /government
product
techcrunch.com /2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/
media-coverage, press/media-coverage
cisa.gov /news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management
government-resource, third-party-advisory, us-government-resource

Sources

CVE List CVE-2023-6376
NVD CVE-2023-6376

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary