CVE-2023-0317 - Vulnerability Details - OpenCVE

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Secomea	Gatemanager

Configuration 1 [-]

cpe:2.3:a:secomea:gatemanager:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.secomea.com/support/cybersecurity-advisory/

History

Wed, 05 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Secomea

Published: 2023-04-19T11:57:46.409Z

Updated: 2025-02-05T15:03:03.498Z

Reserved: 2023-01-16T09:36:00.479Z

Link: CVE-2023-0317

Vulnrichment

Updated: 2024-08-02T05:10:55.186Z

NVD

Status : Modified

Published: 2023-04-19T12:15:07.900

Modified: 2025-02-05T15:15:16.450

Link: CVE-2023-0317

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0317", "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90", "state": "PUBLISHED", "assignerShortName": "Secomea", "dateReserved": "2023-01-16T09:36:00.479Z", "datePublished": "2023-04-19T11:57:46.409Z", "dateUpdated": "2025-02-05T15:03:03.498Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GateManager", "vendor": "Secomea", "versions": [{"lessThan": "10.1", "status": "affected", "version": "10.0", "versionType": "custom"}]}], "datePublic": "2023-04-19T11:57:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information."}], "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information."}], "impacts": [{"capecId": "CAPEC-383", "descriptions": [{"lang": "en", "value": "CAPEC-383 Harvesting Information via API Event Monitoring"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-420", "description": "CWE-420 Unprotected Alternate Channel", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2815942-3388-4c08-ba09-6c15850fda90", "shortName": "Secomea", "dateUpdated": "2023-04-19T11:57:46.409Z"}, "references": [{"url": "https://www.secomea.com/support/cybersecurity-advisory/"}], "source": {"discovery": "INTERNAL"}, "title": "GateManager debug interface is included in non-debug builds", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:10:55.186Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.secomea.com/support/cybersecurity-advisory/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-420", "lang": "en", "description": "CWE-420 Unprotected Alternate Channel"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-05T15:02:04.508680Z", "id": "CVE-2023-0317", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T15:03:03.498Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.secomea.com/support/cybersecurity-advisory/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:10:55.186Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-0317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-05T15:02:04.508680Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-420", "description": "CWE-420 Unprotected Alternate Channel"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T15:02:55.735Z"}}], "cna": {"title": "GateManager debug interface is included in non-debug builds", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-383", "descriptions": [{"lang": "en", "value": "CAPEC-383 Harvesting Information via API Event Monitoring"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Secomea", "product": "GateManager", "versions": [{"status": "affected", "version": "10.0", "lessThan": "10.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2023-04-19T11:57:00.000Z", "references": [{"url": "https://www.secomea.com/support/cybersecurity-advisory/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.", "supportingMedia": [{"type": "text/html", "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-420", "description": "CWE-420 Unprotected Alternate Channel"}]}], "providerMetadata": {"orgId": "f2815942-3388-4c08-ba09-6c15850fda90", "shortName": "Secomea", "dateUpdated": "2023-04-19T11:57:46.409Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0317", "state": "PUBLISHED", "dateUpdated": "2025-02-05T15:03:03.498Z", "dateReserved": "2023-01-16T09:36:00.479Z", "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90", "datePublished": "2023-04-19T11:57:46.409Z", "assignerShortName": "Secomea"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:secomea:gatemanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8852B6D4-560A-4D2E-85FA-34DE8DC890AA", "versionEndExcluding": "10.0.622425017", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information."}], "id": "CVE-2023-0317", "lastModified": "2025-02-05T15:15:16.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "VulnerabilityReporting@secomea.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-04-19T12:15:07.900", "references": [{"source": "VulnerabilityReporting@secomea.com", "tags": ["Vendor Advisory"], "url": "https://www.secomea.com/support/cybersecurity-advisory/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.secomea.com/support/cybersecurity-advisory/"}], "sourceIdentifier": "VulnerabilityReporting@secomea.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-420"}], "source": "VulnerabilityReporting@secomea.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-420"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}