Log in Start free

Vulnerability · Published Sep 6, 2023 · Assigned by INCIBE

CVE-2023-4588File accessibility vulnerability in Delinea Secret Server

Medium 6.8

In plain English

A medium-severity security flaw in Secret Server from Delinea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.3%top 72.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.

Affected products (as reported)

VendorProductVersions
Delinea Secret Server v10.9.000002v11.4.000002

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References