Description
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Delinea | Secret Server | unaffected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-54441 | File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text. |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: INCIBE
Published:
Updated: 2024-09-06T14:12:59.302Z
Reserved: 2023-08-29T07:44:07.813Z
Link: CVE-2023-4588
Vulnrichment
Updated: 2024-08-02T07:31:06.616Z
NVD
Status : Modified
Published: 2023-09-06T12:15:07.827
Modified: 2024-11-21T08:35:29.647
Link: CVE-2023-4588
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses