PT-2023-29749 · Delinea · Delinea Pam Secret Server

3V4Si0N + 1 · Published 2023-09-06 · Updated 2023-09-11 · CVE-2023-4589

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delinea Secret Server version 10.9.000002

Description The issue is related to insufficient verification of data authenticity in the software update process. An attacker with an administrator account could exploit this by performing software updates without proper integrity verification mechanisms, allowing them to inject malicious applications during the update. The update process lacks digital signatures and fails to validate the integrity of the update package.

Recommendations For Delinea Secret Server version 10.9.000002, consider disabling the software update feature until a patch is available to prevent potential exploitation. Restrict access to the update mechanism to minimize the risk of malicious application injection. Avoid using the update process until the issue is resolved with proper integrity verification mechanisms in place. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-4589

Affected Products

Delinea Pam Secret Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-4589 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4589 · Vendor Advisory
• https://t.me/cibsecurity/69999 · Telegram Post
• https://twitter.com/CVEnew/status/1699416765384831251 · Twitter Post
• https://t.me/cvenotify/57944 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server · Note