Lucene search

[email protected]CVE-2023-50444

HistoryDec 13, 2023 - 8:15 p.m.

CVE-2023-50444

2023-12-1320:15:49

CWE-307

[email protected]

web.nvd.nist.gov

cve-2023-50444

zed containers

primx

zonecentral

windows

anssi qualification

encrypted user information

unauthenticated attacker

brute force

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.9%

JSON

By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; and ZED! for Windows, Mac, Linux before 2023.5 include an encrypted version of sensitive user information, which could allow an unauthenticated attacker to obtain it via brute force.

Affected configurations

NVD

Node

primxzed\!Range<q.2020.3enterprisewindows

primxzed\!Range2023.0–2023.5enterprisewindows

primxzed\!Rangeq.2021.0–q.2021.2enterprisewindows

primxzedmailRange<2023.5windows

primxzonecentralRange<q.2021.2windows

primxzonecentralRange2023.0–2023.5windows

CPENameOperatorVersion
primx:zed\!primx zed!ltq.2020.3
primx:zed\!primx zed!lt2023.5
primx:zed\!primx zed!ltq.2021.2
primx:zedmailprimx zedmaillt2023.5
primx:zonecentralprimx zonecentralltq.2021.2
primx:zonecentralprimx zonecentrallt2023.5

CPE	Name	Operator	Version
primx:zed\!	primx zed!	lt	q.2020.3
primx:zed\!	primx zed!	lt	2023.5
primx:zed\!	primx zed!	lt	q.2021.2
primx:zedmail	primx zedmail	lt	2023.5
primx:zonecentral	primx zonecentral	lt	q.2021.2
primx:zonecentral	primx zonecentral	lt	2023.5

References

www.primx.eu/en/bulletins/security-bulletin-23B30874/

www.primx.eu/fr/blog/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.9%

JSON

Related for CVE-2023-50444

cvelist1 nvd1 prion1