PT-2023-29749 · Delinea · Delinea Pam Secret Server

3V4Si0N + 1 · Publicado 2023-09-06 · Atualizado 2023-09-11 · CVE-2023-4589

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delinea Secret Server version 10.9.000002

Description The issue is related to insufficient verification of data authenticity in the software update process. An attacker with an administrator account could exploit this by performing software updates without proper integrity verification mechanisms, allowing them to inject malicious applications during the update. The update process lacks digital signatures and fails to validate the integrity of the update package.

Recommendations For Delinea Secret Server version 10.9.000002, consider disabling the software update feature until a patch is available to prevent potential exploitation. Restrict access to the update mechanism to minimize the risk of malicious application injection. Avoid using the update process until the issue is resolved with proper integrity verification mechanisms in place. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2023-4589

Produtos afetados

Delinea Pam Secret Server

Referências · 6

• https://t.me/cibsecurity/69999 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1699416765384831251 · Publicação no Twitter
• https://t.me/cvenotify/57944 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-4589 · Nota de Segurança
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server · Nota
• https://osv.dev/vulnerability/CVE-2023-4589 · Aviso do Fabricante