CVE-2023-34968

2023-07-2015:15:11

Debian Security Bug Tracker

security-tracker.debian.org

samba

path disclosure

spotlight protocol

rpc request

vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

54.5%

JSON

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

OSVersionArchitecturePackageVersionFilename
Debian12allsamba< 2:4.17.10+dfsg-0+deb12u1samba_2:4.17.10+dfsg-0+deb12u1_all.deb
Debian11allsamba< 2:4.13.13+dfsg-1~deb11u6samba_2:4.13.13+dfsg-1~deb11u6_all.deb
Debian999allsamba< 2:4.18.5+dfsg-1samba_2:4.18.5+dfsg-1_all.deb
Debian13allsamba< 2:4.18.5+dfsg-1samba_2:4.18.5+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	samba	< 2:4.17.10+dfsg-0+deb12u1	samba_2:4.17.10+dfsg-0+deb12u1_all.deb
Debian	11	all	samba	< 2:4.13.13+dfsg-1~deb11u6	samba_2:4.13.13+dfsg-1~deb11u6_all.deb
Debian	999	all	samba	< 2:4.18.5+dfsg-1	samba_2:4.18.5+dfsg-1_all.deb
Debian	13	all	samba	< 2:4.18.5+dfsg-1	samba_2:4.18.5+dfsg-1_all.deb