Lucene search

[email protected]NVD:CVE-2023-41264

HistoryNov 28, 2023 - 5:15 p.m.

CVE-2023-41264

2023-11-2817:15:07

CWE-287

[email protected]

web.nvd.nist.gov

netwrix usercube

authentication bypass

misconfigured installations

on-premises

privilege escalation

deployment endpoints

restsettings.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.4%

JSON

Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, leading to privilege escalation. This only occurs if the configuration omits the required restSettings.AuthorizedClientId and restSettings.AuthorizedSecret fields (for the POST /api/Deployment/ExportConfiguration and POST /api/Deployment endpoints).

Affected configurations

Nvd

Node

netwrixusercubeRange<6.0.215

VendorProductVersionCPE
netwrixusercube*cpe:2.3:a:netwrix:usercube:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netwrix	usercube	*	cpe:2.3:a:netwrix:usercube::::::::

References

www.netwrix.com/identity_governance_and_administration_solution.html

www.synacktiv.com/advisories/usercube-netwrix-multiple-vulnerabilities

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.4%

JSON

Related for NVD:CVE-2023-41264

vulnrichment1 cve1 prion1 cvelist1