Vulnerability · Published Apr 29, 2024 · Assigned by mitre
CVE-2023-52723
High 7.1
In plain English
A high-severity hard-coded credentials in the libkf5ksieve package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libkf5ksieve | 4:22.12.3-1+deb12u1 | DEBIAN-CVE-2023-52723 |
| Ubuntu:22.04:LTS | libkf5ksieve | no fix listed | UBUNTU-CVE-2023-52723 |
Affected products (as reported)
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://invent.kde.org/pim/libksieve/-/commit/6b460ba93ac4ac503ba039d0b788ac7595120db1
- https://invent.kde.org/pim/libksieve/-/tags/v23.03.80
- https://www.openwall.com/lists/oss-security/2024/04/25/1
- [oss-security] 20240430 Re: libksieve (used by kmail/kontact) sent password as username mailing-list
- [debian-lts-announce] 20240505 [SECURITY] [DLA 3809-1] libkf5ksieve security update mailing-list