CVE-2024-37393

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22	Exploit
https://securenvoy.com/support/	Product
https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:securenvoy:multi-factor_authentication_solutions:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-10 20:15

Updated : 2024-07-03 02:04

NVD link : CVE-2024-37393

Mitre link : CVE-2024-37393

CVE.ORG link : CVE-2024-37393

JSON object : View

Products Affected

securenvoy

multi-factor_authentication_solutions

CWE

CWE-319

Cleartext Transmission of Sensitive Information

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-37393", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-06-10T20:15:15.293", "references": [{"url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://securenvoy.com/support/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de inyecciones LDAP en SecurEnvoy MFA antes de la versi\u00f3n 9.4.514 debido a una validaci\u00f3n incorrecta de la entrada proporcionada por el usuario. Un atacante remoto no autenticado podr\u00eda exfiltrar datos de Active Directory mediante ataques de inyecci\u00f3n LDAP ciegos contra el servicio DESKTOP expuesto en el endpoint HTTP /secserver. Esto puede incluir ms-Mcs-AdmPwd, que tiene una contrase\u00f1a de texto plano para la funci\u00f3n Soluci\u00f3n de contrase\u00f1a de administrador local (LAPS)."}], "lastModified": "2024-07-03T02:04:18.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:securenvoy:multi-factor_authentication_solutions:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D30EF233-2538-42B4-AF36-5667C8C38755", "versionEndExcluding": "9.4.514"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}