CVE-2023-33254

Katalog CVE

CVSS 6.5 · Medium EPSS 3,2%

Kerentanan Incorrect Authorization pada quest kace systems deployment appliance. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain. To exploit this, an authenticated attacker edits the user-authentication settings to specify an attacker-controlled LDAP server, clicks the Test Settings button, and captures the cleartext credentials.

Rincian

Terbit di NVD

21 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.stevencampbell.info/KACE-LDAP-Bind-Credential-Exposure/ exploit · advisory pihak ketiga