CVE-2023-45083

An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding. This issue affects HyperCloud versions 1.0 to any release before 2.1.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.6 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisories.softiron.cloud	Release Notes
https://advisories.softiron.cloud	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:softiron:hypercloud:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-05 17:15

Updated : 2024-11-21 08:26

NVD link : CVE-2023-45083

Mitre link : CVE-2023-45083

CVE.ORG link : CVE-2023-45083

JSON object : View

Products Affected

softiron

hypercloud

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2023-45083", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "0a72a055-908d-47f5-a16a-1f09049c16c6", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2023-12-05T17:15:07.950", "references": [{"url": "https://advisories.softiron.cloud", "tags": ["Release Notes"], "source": "0a72a055-908d-47f5-a16a-1f09049c16c6"}, {"url": "https://advisories.softiron.cloud", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "0a72a055-908d-47f5-a16a-1f09049c16c6", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane.\n\nAn authenticated admin-level user may be able to delete the \"admin\" or \"serveradmin\" users, which prevents authentication from subsequently succeeding.\n\nThis issue affects HyperCloud versions 1.0 to any release before 2.1.\n\n"}, {"lang": "es", "value": "Existe una vulnerabilidad de gesti\u00f3n de privilegios inadecuada en HyperCloud que afectar\u00e1 la capacidad de un usuario para autenticarse en el plano de gesti\u00f3n. Un usuario de nivel de administrador autenticado puede eliminar los usuarios \"admin\" o \"serveadmin\", lo que impide que la autenticaci\u00f3n se realice correctamente posteriormente. Este problema afecta a las versiones 1.0 de HyperCloud hasta cualquier versi\u00f3n anterior a la 2.1."}], "lastModified": "2024-11-21T08:26:21.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:softiron:hypercloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "554F36F7-6344-4F7A-A1BE-196927DD04E5", "versionEndExcluding": "2.1.0", "versionStartIncluding": "1.0"}], "operator": "OR"}]}], "sourceIdentifier": "0a72a055-908d-47f5-a16a-1f09049c16c6"}