CVE-2023-22947

Katalog CVE

CVSS 7.3 · High EPSS 0,31%

Kerentanan Uncontrolled Search Path Element pada shibboleth service provider. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."

Rincian

Terbit di NVD

11 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://shibboleth.atlassian.net/browse/SSPCPP-961 exploit · issue tracking · advisory pihak ketiga
• https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs advisory pihak ketiga