CVE-2023-23370

An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-23-36	Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-36	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:qnap:qvpn:*:*:*:*:*:windows:*:*

History

21 Nov 2024, 07:46

Type	Values Removed	Values Added
References	~~() https://www.qnap.com/en/security-advisory/qsa-23-36 - Vendor Advisory~~	() https://www.qnap.com/en/security-advisory/qsa-23-36 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.4~~	v2 : unknown v3 : 6.7

11 Oct 2023, 17:28

Type	Values Removed	Values Added
CPE		cpe:2.3:a:qnap:qvpn::::::windows::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.4
First Time		Qnap Qnap qvpn
CWE		CWE-522
References	~~(MISC) https://www.qnap.com/en/security-advisory/qsa-23-36 -~~	(MISC) https://www.qnap.com/en/security-advisory/qsa-23-36 - Vendor Advisory

06 Oct 2023, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-06 17:15

Updated : 2024-11-21 07:46

NVD link : CVE-2023-23370

Mitre link : CVE-2023-23370

CVE.ORG link : CVE-2023-23370

JSON object : View

Products Affected

qnap

qvpn

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2023-23370", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2023-10-06T17:15:11.920", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-23-36", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}, {"url": "https://www.qnap.com/en/security-advisory/qsa-23-36", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors.\n\nWe have already fixed the vulnerability in the following version:\nQVPN Windows 2.1.0.0518 and later\n"}, {"lang": "es", "value": "Se ha informado que una vulnerabilidad de credenciales insuficientemente protegidas afecta a QVPN Device Client. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores locales autenticados obtener acceso a cuentas de usuario y acceder a datos confidenciales utilizados por la cuenta de usuario a trav\u00e9s de vectores no especificados. Ya hemos solucionado la vulnerabilidad en la siguiente versi\u00f3n: QVPN Windows 2.1.0.0518 y posteriores"}], "lastModified": "2024-11-21T07:46:03.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qvpn:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "ECFD664D-C113-4227-8359-0D9433A03B18", "versionEndExcluding": "2.1.0.0518", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}