PT-2023-5850 · Qvpn · Qvpn Device Client

Runzi Zhao · Publicado 2023-10-06 · Atualizado 2023-10-11 · CVE-2023-23371

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Média

Vetor base

AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions QVPN Device Client versions prior to 2.2.0.0823

Description A cleartext transmission of sensitive information issue has been reported, which could allow local authenticated administrators to read sensitive data via unspecified vectors.

Recommendations For versions prior to 2.2.0.0823, update to QVPN Windows 2.2.0.0823 or later to resolve the issue.

Correção

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-310

CWE-319

CWE-311

Identificadores relacionados

BDU:2023-06537

CVE-2023-23371

Produtos afetados

Qvpn Device Client

Referências · 10

• https://vuldb.com/ru/?id.241477 · Nota
• https://bdu.fstec.ru/vul/2023-06537 · Nota de Segurança
• https://qnap.com/en/security-advisory/qsa-23-39 · Aviso do Fabricante
• https://t.me/cibsecurity/71746 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1710366692776231079 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-23371 · Aviso do Fabricante
• https://t.me/cvenotify/59279 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023100911 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-23371 · Nota de Segurança
• https://twitter.com/CVEnew/status/1710337331423560095 · Publicação no Twitter