PT-2023-29741 · Delinea · Delinea Pam Secret Server

3V4Si0N + 1 · Publicado 2023-09-06 · Atualizado 2023-09-11 · CVE-2023-4588

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Delinea Secret Server versions 10.9.000002 through 11.4.000002

Description The issue allows an authenticated user with administrative privileges to create a backup file in the application's webroot directory by changing the default backup directory to the wwwroot folder. This enables the user to download the backup file along with certain configuration files, including encryption.config and database.config, which are stored in the wwwroot directory. As a result, database credentials are exposed in plain text.

Recommendations For versions 10.9.000002 and 11.4.000002, consider restricting access to the backup functionality and the wwwroot directory to prevent unauthorized downloads of sensitive configuration files. Additionally, as a temporary workaround, consider disabling the ability to change the default backup directory to the wwwroot folder until a patch is available.

Correção

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

CVE-2023-4588

Produtos afetados

Delinea Pam Secret Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-4588 · Nota de Segurança
• https://twitter.com/CVEnew/status/1699390481833279813 · Publicação no Twitter
• https://t.me/cibsecurity/70004 · Publicação no Telegram
• https://t.me/cvenotify/57943 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-4588 · Aviso do Fabricante
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server · Nota