CVE-2023-38994
- State
- Published
- Severity
- 7.9 High
- Published
- Oct 31, 2023
- Updated
- Apr 15, 2025
- Reserved
- Jul 25, 2023
Description
The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.9 High | CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:H/S:C/UI:N | mitre |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://forge.univention.org/bugzilla/show_bug.cgi?id=56324
- https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network
- https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0
- https://raeph123.github.io/BlogPosts/Univention/Simple_yet_effective_The_story_of_some_simple_bugs_that_led_to_the_complete_compromise_of_a_network_en.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.