CVE-2024-37393

{"id": "CVE-2024-37393", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-06-10T20:15:15.293", "references": [{"url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://securenvoy.com/support/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de inyecciones LDAP en SecurEnvoy MFA antes de la versi\u00f3n 9.4.514 debido a una validaci\u00f3n incorrecta de la entrada proporcionada por el usuario. Un atacante remoto no autenticado podr\u00eda exfiltrar datos de Active Directory mediante ataques de inyecci\u00f3n LDAP ciegos contra el servicio DESKTOP expuesto en el endpoint HTTP /secserver. Esto puede incluir ms-Mcs-AdmPwd, que tiene una contrase\u00f1a de texto plano para la funci\u00f3n Soluci\u00f3n de contrase\u00f1a de administrador local (LAPS)."}], "lastModified": "2024-07-03T02:04:18.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:securenvoy:multi-factor_authentication_solutions:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D30EF233-2538-42B4-AF36-5667C8C38755", "versionEndExcluding": "9.4.514"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}