Lucene search

[email protected]NVD:CVE-2023-38994

HistoryOct 31, 2023 - 12:15 p.m.

CVE-2023-38994

2023-10-3112:15:08

CWE-668

[email protected]

web.nvd.nist.gov

cve-2023-38994

prometheus monitoring

ucs 5.0-5

ldap plaintext password

local ssh access

higher privileges

followup attacks

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

The ‘check_univention_joinstatus’ prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.

Affected configurations

Nvd

Node

univentionunivention_corporate_serverMatch5.0

VendorProductVersionCPE
univentionunivention_corporate_server5.0cpe:2.3:o:univention:univention_corporate_server:5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
univention	univention_corporate_server	5.0	cpe:2.3:o:univention:univention_corporate_server:5.0:::::::*

References

forge.univention.org/bugzilla/show_bug.cgi?id=56324

forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0

www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for NVD:CVE-2023-38994

cvelist1 prion1 cve1