PT-2023-21849 · Stormshield · Stormshield Network Security

Published 2023-12-25 · Updated 2024-08-20 · CVE-2023-28616

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stormshield Network Security (SNS) versions 4.3.x through 4.3.16 Stormshield Network Security (SNS) versions 4.4.x through 4.6.x before 4.6.4 Stormshield Network Security (SNS) versions 4.7.x before 4.7.1

Description The issue affects user accounts with passwords containing an equals sign or space character. The serverd process logs such passwords in cleartext and potentially sends these logs to the Syslog component.

Recommendations For versions 4.3.x through 4.3.16, update to version 4.3.17 or later. For versions 4.4.x through 4.6.x before 4.6.4, update to version 4.6.4 or later. For versions 4.7.x before 4.7.1, update to version 4.7.1 or later. As a temporary workaround, consider restricting the use of passwords with equals signs or space characters until a patch is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-28616

Affected Products

Stormshield Network Security

References · 8

• https://osv.dev/vulnerability/CVE-2023-28616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28616 · Security Note
• https://advisories.stormshield.eu/2023-006 · Vendor Advisory
• https://t.me/cvenotify/91301 · Telegram Post
• https://t.me/cvenotify/65117 · Telegram Post
• https://twitter.com/CVEnew/status/1739501007095140436 · Twitter Post
• https://t.me/cvenotify/66206 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1739536593675833532 · Twitter Post