CVE-2023-38994

HIGH7.9

The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5

Published Oct 31, 2023

Modified 1 years ago

Details

The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.

References

WEB

https://forge.univention.org/bugzilla/show_bug.cgi?id=56324

WEB

https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0

WEB

https://raeph123.github.io/BlogPosts/Univention/Simple_yet_effective_The_story_of_some_simple_bugs_that_led_to_the_complete_compromise_of_a_network_en.html

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2023-38994

WEB

https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network

CVSS Analysis