PT-2023-31552 · Unknown+1 · Zed! For Mac+5

Published 2023-12-13 · Updated 2023-12-20 · CVE-2023-50444

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZED! for Windows versions before Q.2020.3 through Q.2021.2 ZONECENTRAL for Windows versions before Q.2021.2 through 2023.5 ZEDMAIL for Windows versions before 2023.5 ZED! for Windows, Mac, Linux versions before 2023.5

Description The issue concerns .ZED containers produced by PRIMX products, which by default include an encrypted version of sensitive user information. This could allow an unauthenticated attacker to obtain the information via brute force.

Recommendations For ZED! for Windows versions before Q.2020.3 through Q.2021.2, update to a version after Q.2021.2. For ZONECENTRAL for Windows versions before Q.2021.2 through 2023.5, update to a version after 2023.5. For ZEDMAIL for Windows versions before 2023.5, update to a version after 2023.5. For ZED! for Windows, Mac, Linux versions before 2023.5, update to a version after 2023.5.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-50444

Affected Products

Primx

Zed! For Linux

Zed! For Mac

Zed! For Windows

Zedmail For Windows

Zonecentral For Windows

References · 7

• https://osv.dev/vulnerability/CVE-2023-50444 · Vendor Advisory
• https://primx.eu/en/bulletins/security-bulletin-23B30874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50444 · Security Note
• https://twitter.com/RedPacketSec/status/1735602615143002605 · Twitter Post
• https://primx.eu/fr/blog · Note
• https://twitter.com/VulmonFeeds/status/1735049419911811077 · Twitter Post
• https://twitter.com/CVEnew/status/1735031014701908275 · Twitter Post