CVE-2023-3266
- State
- Published
- Severity
- 9.8 Critical
- Published
- Aug 14, 2023
- Updated
- Oct 9, 2024
- Reserved
- Jun 15, 2023
Description
A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also requires the attacker to know at least one username on the device, but any password will authenticate successfully.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | trellix |
Weaknesses
- CWE-358 Improperly Implemented Security Check for Standard
Affected Products
| Product | Versions |
|---|---|
PowerPanel EnterpriseCyberPower |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.