PT-2023-27224 · One Identity · One Identity Password Manager

Roi Hay · Published 2023-09-27 · Updated 2023-09-29 · CVE-2023-4003

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions One Identity Password Manager version 5.9.7.1

Description An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. This issue is related to execution with unnecessary privileges.

Recommendations For One Identity Password Manager version 5.9.7.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2023-4003

Affected Products

One Identity Password Manager

References · 4

• https://osv.dev/vulnerability/CVE-2023-4003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4003 · Security Note
• https://gov.il/en/Departments/faq/cve_advisories · Note
• https://twitter.com/CVEnew/status/1707009488262193267 · Twitter Post