Lucene search

K
cve[email protected]CVE-2023-28616
HistoryDec 26, 2023 - 4:15 a.m.

CVE-2023-28616

2023-12-2604:15:07
CWE-319
web.nvd.nist.gov
10
cve
2023
28616
stormshield network security
sns
password security
cleartext password
syslog
vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.2%

An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.

Affected configurations

NVD
Node
stormshieldnetwork_securityRange2.7.04.3.17
OR
stormshieldnetwork_securityRange4.4.04.6.4
OR
stormshieldnetwork_securityMatch4.7.0

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.2%

Related for CVE-2023-28616