Lucene search

K
vulnrichmentINCIBEVULNRICHMENT:CVE-2023-4588
HistorySep 06, 2023 - 11:43 a.m.

CVE-2023-4588 File accessibility vulnerability in Delinea Secret Server

2023-09-0611:43:19
CWE-552
INCIBE
github.com
file accessibility
delinea secret server
vulnerability
administrative privileges
backup file
webroot directory
configuration files
database credentials

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

26.1%

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application’s webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

26.1%

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

Related for VULNRICHMENT:CVE-2023-4588