CVE-2023-38994

Katalog CVE

CVSS 7.8 · High EPSS 0,35%

Kerentanan Exposure of Resource to Wrong Sphere pada univention corporate server. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.

Rincian

Terbit di NVD

31 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324 issue tracking · advisory vendor
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0 issue tracking · advisory vendor
• https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-... exploit · deskripsi teknis · advisory pihak ketiga
• https://raeph123.github.io/BlogPosts/Univention/Simple_yet_effective_The_story_of_some_simple_bugs_that_led_to...