PT-2023-32290 · Microsoft · Windows

Alexander Ratelle · Publicado 2023-11-06 · Atualizado 2023-11-14 · CVE-2023-5719

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Crimson 3.2

Description The issue arises when the Windows-based configuration tool is used to define new passwords for users, and these passwords contain the percent (%) character. This can lead to invalid values being included, potentially truncating the string if a NUL is encountered. As a result, if the simplified password is not detected by the administrator, the device might be left in a vulnerable state due to more easily compromised credentials. It's noted that passwords entered via the Crimson system web server do not suffer from this issue.

Recommendations For The Crimson 3.2, avoid using passwords that contain the percent (%) character until a fix is available. As a temporary workaround, consider manually reviewing and verifying all passwords defined through the Windows-based configuration tool to ensure they do not contain the percent character, which could lead to compromised credentials.

Correção

Enumeração de Fraquezas

CWE-158

Identificadores relacionados

CVE-2023-5719

Produtos afetados

Windows

Referências · 5

• https://cisa.gov/news-events/ics-advisories/icsa-23-306-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5719 · Nota de Segurança
• https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-5719 · Aviso do Fabricante
• https://t.me/cibsecurity/73630 · Publicação no Telegram