PT-2023-21582 · Unknown · Ui Desktop

Published 2023-04-19 · Updated 2023-05-01 · CVE-2023-28124

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UI Desktop for Windows versions 0.59.1.71 and earlier

Description The issue arises from improper usage of symmetric encryption in UI Desktop, potentially allowing users with access to configuration files to decrypt their content. This could lead to unauthorized access to sensitive information.

Recommendations For versions 0.59.1.71 and earlier, update to version 0.62.3 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2023-28124

Affected Products

Ui Desktop

References · 3

• https://osv.dev/vulnerability/CVE-2023-28124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28124 · Security Note
• https://community.ui.com/releases/Security-Advisory-Bulletin-029-029/a47c68f2-1f3a-47c3-b577-eb70599644e4 · Vendor Advisory