Lucene search

DellCVELIST:CVE-2023-44303

HistoryNov 24, 2023 - 2:38 a.m.

CVE-2023-44303

2023-11-2402:38:09

CWE-310

dell

www.cve.org

rvtools

version 3.9.2

sensitive data exposure

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

44.9%

JSON

RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main application (RVTools.exe). A remote unauthenticated attacker with access to stored encrypted passwords from a users’ system could potentially exploit this vulnerability, leading to the disclosure of encrypted passwords in clear text. This vulnerability is caused by an incomplete fix for CVE-2020-27688.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "RVTools ",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 3.9.2 through 4.4.5 "
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000219712/dsa-2023-426-security-update-for-rvtools-vulnerabilities

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

44.9%

JSON

Related for CVELIST:CVE-2023-44303