CVE-2023-47250

Katalog CVE

CVSS 8.8 · High EPSS 1,4%

Kerentanan Incorrect Default Permissions pada m-privacy mprivacy-tools, m-privacy rsbac-policy-tgpro +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop, including the ability to inject keystrokes and perform a keylogging attack.

Rincian

Terbit di NVD

22 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2023/Nov/13 exploit · mailing list · advisory pihak ketiga
• https://sec-consult.com/en/vulnerability-lab/advisories/index.html advisory pihak ketiga
• https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-m-privacy-tightgate-pro/ advisory pihak ketiga
• https://www.m-privacy.de/en/tightgate-pro-safe-surfing/ product