Beyondtrust · Beyondtrust Privileged Remote Access · CVE-2023-23632
**Name of the Vulnerable Software and Affected Versions**
BeyondTrust Privileged Remote Access (PRA) versions 22.2.x through 22.4.x
**Description**
The issue concerns a local authentication bypass in BeyondTrust Privileged Remote Access (PRA). Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions. This allows unauthorized access to jump items by guessing only the first character of the secret.
**Recommendations**
For versions 22.2.x through 22.4.x, consider disabling the BYOT shell jump sessions as a temporary workaround until a patch is available. Restrict access to the jump items to minimize the risk of exploitation. Avoid using the flawed secret verification process in the BYOT shell jump sessions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.