Lucene search

[email protected]CVE-2023-23370

HistoryOct 06, 2023 - 5:15 p.m.

CVE-2023-23370

2023-10-0617:15:11

CWE-522

[email protected]

web.nvd.nist.gov

cve-2023-23370

qvpn device client

credentials vulnerability

user accounts

sensitive data

local authenticated admins

nvd

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.

We have already fixed the vulnerability in the following version:
QVPN Windows 2.1.0.0518 and later

Affected configurations

NVD

Node

qnapqvpnRange2.1.0–2.1.0.0518windows

CPENameOperatorVersion
qnap:qvpnqnap qvpnlt2.1.0.0518

CPE	Name	Operator	Version
qnap:qvpn	qnap qvpn	lt	2.1.0.0518

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QVPN Windows",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.0.0518",
        "status": "affected",
        "version": "2.1.x",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-23-36

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-23370

nvd1 prion1 cvelist1