CVE-2023-52723

2024-04-2906:15:06

Debian Security Bug Tracker

security-tracker.debian.org

kde

libksieve

password

logs

unix

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

7.4

Confidence

Low

EPSS

Percentile

15.5%

JSON

In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.

OSVersionArchitecturePackageVersionFilename
Debian12alllibkf5ksieve< 4:22.12.3-1+deb12u1libkf5ksieve_4:22.12.3-1+deb12u1_all.deb
Debian11alllibkf5ksieve< 4:20.08.3-1+deb11u1libkf5ksieve_4:20.08.3-1+deb11u1_all.deb
Debian999alllibkf5ksieve< 4:22.12.3-2libkf5ksieve_4:22.12.3-2_all.deb
Debian13alllibkf5ksieve< 4:22.12.3-2libkf5ksieve_4:22.12.3-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libkf5ksieve	< 4:22.12.3-1+deb12u1	libkf5ksieve_4:22.12.3-1+deb12u1_all.deb
Debian	11	all	libkf5ksieve	< 4:20.08.3-1+deb11u1	libkf5ksieve_4:20.08.3-1+deb11u1_all.deb
Debian	999	all	libkf5ksieve	< 4:22.12.3-2	libkf5ksieve_4:22.12.3-2_all.deb
Debian	13	all	libkf5ksieve	< 4:22.12.3-2	libkf5ksieve_4:22.12.3-2_all.deb