CVE-2023-23370

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-23-36	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:qnap:qvpn:*:*:*:*:*:windows:*:*

History

No history.

Information

Published : 2023-10-06 17:15

Updated : 2023-10-11 17:28

NVD link : CVE-2023-23370

Mitre link : CVE-2023-23370

CVE.ORG link : CVE-2023-23370

JSON object : View

Products Affected

qnap

qvpn

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2023-23370", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.5}]}, "published": "2023-10-06T17:15:11.920", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-23-36", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.\n\nWe have already fixed the vulnerability in the following version:\nQVPN Windows 2.1.0.0518 and later\n"}, {"lang": "es", "value": "Se ha informado que una vulnerabilidad de credenciales insuficientemente protegidas afecta a QVPN Device Client. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores locales autenticados obtener acceso a cuentas de usuario y acceder a datos confidenciales utilizados por la cuenta de usuario a trav\u00e9s de vectores no especificados. Ya hemos solucionado la vulnerabilidad en la siguiente versi\u00f3n: QVPN Windows 2.1.0.0518 y posteriores"}], "lastModified": "2023-10-11T17:28:51.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qvpn:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "ECFD664D-C113-4227-8359-0D9433A03B18", "versionEndExcluding": "2.1.0.0518", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}