CVE-2023-4154

🗓️ 07 Nov 2023 19:14:28Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 233 Views

Design flaw in Samba's DirSync control exposes passwords and secrets in Active Directory to privileged users and RODCs, allowing access to sensitive attributes

Reporter	Title	Published	Views	Family All 109
ATTACKERKB	CVE-2023-4154	7 Nov 202320:15	–	attackerkb
AlpineLinux	CVE-2023-4154	7 Nov 202319:14	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в samba	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the DirSync synchronization mechanism in the Samba networking communication software package allows a intruder to gain unauthorized access to protected information and enhance their privileges.	21 Oct 202300:00	–	bdu_fstec
Cloud Foundry	USN-6425-1: Samba vulnerabilities \| Cloud Foundry	9 Nov 202300:00	–	cloudfoundry
Circl	CVE-2023-4154	21 Jan 202621:18	–	circl
CNNVD	Samba Security Vulnerabilities	13 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-4154 Samba: ad dc password exposure to privileged users and rodcs	7 Nov 202319:14	–	cvelist
Debian	[SECURITY] [DSA 5525-1] samba security update	11 Oct 202318:14	–	debian
Debian CVE	CVE-2023-4154	7 Nov 202319:14	–	debiancve

NVD

Node

samba sambaRange4.0.0–4.17.12

samba sambaRange4.18.0–4.18.8

samba sambaRange4.19.0–4.19.1

[
  {
    "product": "samba",
    "vendor": "n/a",
    "versions": [
      {
        "version": "4.19.1",
        "status": "unaffected"
      },
      {
        "version": "4.18.8",
        "status": "unaffected"
      },
      {
        "version": "4.17.12",
        "status": "unaffected"
      }
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "samba",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "samba4",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "samba",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "samba",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "samba",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Storage 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "samba",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:storage:3"
    ]
  },
  {
    "product": "Fedora",
    "vendor": "Fedora",
    "collectionURL": "https://packages.fedoraproject.org/",
    "packageName": "samba",
    "defaultStatus": "affected"
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20231124-0002/
bugzilla	www.bugzilla.samba.org/show_bug.cgi
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
samba	www.samba.org/samba/security/CVE-2023-4154.html
access	www.access.redhat.com/security/cve/CVE-2023-4154

17 Jun 2026 06:37Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.5 - 7.5

EPSS0.01151

CWE-787