Vulnerability · Published Dec 5, 2023 · Assigned by SoftIron
CVE-2023-45083HyperCloud: "admin" and "serveradmin" users can be deleted
Medium 4.2
In plain English
A medium-severity privilege mismanagement in HyperCloud from SoftIron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding. This issue affects HyperCloud versions 1.0 to any release before 2.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SoftIron | HyperCloud | 1.0 – before 2.1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H