2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Secret Server","vendor":"Delinea","versions":[{"status":"affected","version":"v10.9.000002"}]}],"source":"cve-coordination@incibe.es"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:delinea:secret_server:10.9.000002:*:*:*:*:*:*:*","matchCriteriaId":"0549C65A-06F9-41D4-BF9C-D303A8BC578C","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update."},{"lang":"es","value":"Vulnerabilidad de verificación insuficiente de autenticidad de datos en Delinea Secret Server, en su versión v10.9.000002. Un atacante con una cuenta de administrador podría realizar actualizaciones de software sin los mecanismos adecuados de verificación de integridad. En este escenario, el proceso de actualización carece de firmas digitales y no logra validar la integridad del paquete de actualización, lo que permite al atacante inyectar aplicaciones maliciosas durante la actualización.\n"}],"id":"CVE-2023-4589","lastModified":"2026-06-17T06:38:10.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"cve-coordination@incibe.es","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-4589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-09-26T17:55:50.932986Z","version":"2.0.3"}}]},"published":"2023-09-06T12:15:07.967","references":[{"source":"cve-coordination@incibe.es","tags":["Third Party Advisory"],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"cve-coordination@incibe.es","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-345"}],"source":"nvd@nist.gov","type":"Primary"}]}
|