CVE-2023-50439

ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before 2023.5, or ZEDMAIL for Windows before 2023.5 disclose the original path in which the containers were created, which allows an unauthenticated attacker to obtain some information regarding the context of use (project name, etc.).

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.primx.eu/en/bulletins/security-bulletin-23B30930/	Vendor Advisory
https://www.primx.eu/fr/blog/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:primx:zed\!:::::enterprise:windows::
	cpe:2.3:a:primx:zed\!:::::enterprise:windows::
	cpe:2.3:a:primx:zed\!:::::enterprise:windows::
	cpe:2.3:a:primx:zedmail::::::windows::*
	cpe:2.3:a:primx:zonecentral::::::windows::*
	cpe:2.3:a:primx:zonecentral::::::windows::*

History

20 Dec 2023, 18:29

Type	Values Removed	Values Added
CPE		cpe:2.3:a:primx:zonecentral::::::windows::* cpe:2.3:a:primx:zedmail::::::windows::* cpe:2.3:a:primx:zed\!:::::enterprise:windows::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CWE		NVD-CWE-noinfo
References	~~() https://www.primx.eu/en/bulletins/security-bulletin-23B30930/ -~~	() https://www.primx.eu/en/bulletins/security-bulletin-23B30930/ - Vendor Advisory
References	~~() https://www.primx.eu/fr/blog/ -~~	() https://www.primx.eu/fr/blog/ - Product

13 Dec 2023, 21:25

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-13 21:15

Updated : 2024-02-05 00:22

NVD link : CVE-2023-50439

Mitre link : CVE-2023-50439

CVE.ORG link : CVE-2023-50439

JSON object : View

Products Affected

primx

zonecentral
zedmail
zed\!

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-50439", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-12-13T21:15:09.563", "references": [{"url": "https://www.primx.eu/en/bulletins/security-bulletin-23B30930/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.primx.eu/fr/blog/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before 2023.5, or ZEDMAIL for Windows before 2023.5 disclose the original path in which the containers were created, which allows an unauthenticated attacker to obtain some information regarding the context of use (project name, etc.)."}, {"lang": "es", "value": "Contenedores ZED producidos por PRIMX ZED! para Windows anterior a Q.2020.3 (env\u00edo de calificaci\u00f3n ANSSI), ZED! para Windows antes de Q.2021.2 (env\u00edo de calificaci\u00f3n ANSSI), ZONECENTRAL para Windows antes de Q.2021.2 (env\u00edo de calificaci\u00f3n ANSSI), ZONECENTRAL para Windows antes de 2023.5 o ZEDMAIL para Windows antes de 2023.5 divulgan la ruta original en la que se crearon los contenedores, lo que permite un atacante no autenticado para obtener informaci\u00f3n sobre el contexto de uso (nombre del proyecto, etc.)."}], "lastModified": "2023-12-20T18:29:44.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:primx:zed\\!:*:*:*:*:enterprise:windows:*:*", "vulnerable": true, "matchCriteriaId": "7C67598A-6CE7-4802-BB1F-65D40CF38DAC", "versionEndExcluding": "q.2020.3"}, {"criteria": "cpe:2.3:a:primx:zed\\!:*:*:*:*:enterprise:windows:*:*", "vulnerable": true, "matchCriteriaId": "1B21D96F-47D7-4DE6-80AD-68986FF75C77", "versionEndExcluding": "2023.5", "versionStartIncluding": "2023.0"}, {"criteria": "cpe:2.3:a:primx:zed\\!:*:*:*:*:enterprise:windows:*:*", "vulnerable": true, "matchCriteriaId": "747C7A04-7E6E-4A2C-BCFC-01EC16ABE951", "versionEndExcluding": "q.2021.2", "versionStartIncluding": "q.2021.0"}, {"criteria": "cpe:2.3:a:primx:zedmail:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "01B1BDF0-697E-4EA2-8E26-5B786E03FCF1", "versionEndExcluding": "2023.5"}, {"criteria": "cpe:2.3:a:primx:zonecentral:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "60E1C4D1-FD43-44D1-90E3-0A3936D947A2", "versionEndExcluding": "q.2021.2"}, {"criteria": "cpe:2.3:a:primx:zonecentral:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "5FA52575-445D-48F8-B1D9-F3981DDBD5D3", "versionEndExcluding": "2023.5", "versionStartIncluding": "2023.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}