Lucene search

INCIBECVELIST:CVE-2023-4588

HistorySep 06, 2023 - 11:43 a.m.

CVE-2023-4588 File accessibility vulnerability in Delinea Secret Server

2023-09-0611:43:19

CWE-552

INCIBE

www.cve.org

vulnerability

delinea secret server

file accessibility

authentication

administrative privileges

backup files

configuration files

plain text.

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

26.1%

JSON

File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application’s webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secret Server",
    "vendor": "Delinea",
    "versions": [
      {
        "status": "affected",
        "version": "v10.9.000002"
      },
      {
        "status": "affected",
        "version": "v11.4.000002"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

26.1%

JSON

Related for CVELIST:CVE-2023-4588