PT-2023-5851 · Qvpn · Qvpn Device Client+1

Runzi Zhao · Publicado 2023-10-06 · Atualizado 2023-10-11 · CVE-2023-23370

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions QVPN Device Client versions prior to 2.1.0.0518

Description The issue is related to insufficient protection of credentials, which could allow local authenticated administrators to gain access to user accounts and sensitive data via unspecified vectors.

Recommendations For versions prior to 2.1.0.0518, update to QVPN Windows 2.1.0.0518 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

BDU:2023-06538

CVE-2023-23370

Produtos afetados

Qvpn Device Client

Qvpn Windows

Referências · 10

• https://t.me/cvenotify/59084 · Publicação no Telegram
• https://qnap.com/en/security-advisory/qsa-23-36 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1710365426989879784 · Publicação no Twitter
• https://cybersecurity-help.cz/vdb/SB2023100912 · Nota
• https://osv.dev/vulnerability/CVE-2023-23370 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23370 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06538 · Nota de Segurança
• https://t.me/cibsecurity/71738 · Publicação no Telegram
• https://vuldb.com/ru/?id.241476 · Nota
• https://twitter.com/CVEnew/status/1710337332493070448 · Publicação no Twitter