Lucene search

INCIBECVELIST:CVE-2023-4589

HistorySep 06, 2023 - 11:48 a.m.

CVE-2023-4589 Insufficient verification of data authenticity vulnerability in Delinea Secret Server

2023-09-0611:48:59

CWE-345

INCIBE

www.cve.org

cve-2023-4589

delinea secret server

integrity verification

software updates

digital signatures

malicious applications

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

JSON

Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secret Server",
    "vendor": "Delinea",
    "versions": [
      {
        "status": "affected",
        "version": "v10.9.000002"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

JSON

Related for CVELIST:CVE-2023-4589