Search criteria

3 vulnerabilities

CVE-2023-3897 (GCVE-0-2023-3897)

Vulnerability from cvelistv5 – Published: 2023-07-25 08:59 – Updated: 2025-02-13 17:02
VLAI?
Summary
Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version
Severity ?
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Onpremise SureMDM Solution SureMDM Onpremise Affected: 6.31
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:08:50.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.42gears.com/security-and-compliance"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/177179/SureMDM-On-Premise-CAPTCHA-Bypass-User-Enumeration.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SureMDM Onpremise",
          "vendor": "Onpremise SureMDM Solution",
          "versions": [
            {
              "status": "affected",
              "version": "6.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message.\n\n\u003cp\u003eThis issue affects SureMDM On-premise: 6.31 and below version\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message.\n\nThis issue affects SureMDM On-premise: 6.31 and below version"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-261",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-203",
              "description": "CWE-203 Observable Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-19T17:05:53.850Z",
        "orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
        "shortName": "42Gears"
      },
      "references": [
        {
          "url": "https://www.42gears.com/security-and-compliance"
        },
        {
          "url": "http://packetstormsecurity.com/files/177179/SureMDM-On-Premise-CAPTCHA-Bypass-User-Enumeration.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to the latest version of\u0026nbsp;On-premise SureMDM Solution."
            }
          ],
          "value": "Upgrade to the latest version of\u00a0On-premise SureMDM Solution."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bypassing CAPTCHA \u0026 Enumerating Usernames via Password Reset Page",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
    "assignerShortName": "42Gears",
    "cveId": "CVE-2023-3897",
    "datePublished": "2023-07-25T08:59:31.668Z",
    "dateReserved": "2023-07-25T06:14:06.274Z",
    "dateUpdated": "2025-02-13T17:02:37.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2335 (GCVE-0-2023-2335)

Vulnerability from cvelistv5 – Published: 2023-04-27 17:55 – Updated: 2025-01-30 20:54
VLAI?
Summary
Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-314 - Cleartext Storage in the Registry
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
42gears surelock windows Affected: 2.3.12 , ≤ 2.40.0 (Patch)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:19:14.760Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.42gears.com/security-and-compliance/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2335",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T20:54:37.364693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-30T20:54:42.317Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://mars.42gears.com/support/inout/surelockwinsetupv2.40.0.exe",
          "defaultStatus": "unaffected",
          "modules": [
            "Registery"
          ],
          "packageName": "surelockwinsetupv2.40.0.exe",
          "platforms": [
            "Windows"
          ],
          "product": "surelock windows",
          "vendor": "42gears",
          "versions": [
            {
              "lessThanOrEqual": "2.40.0",
              "status": "affected",
              "version": "2.3.12",
              "versionType": "Patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: transparent;\"\u003ePlaintext Password in Registry\u003c/span\u003e\n\n vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve \n\n\u003cspan style=\"background-color: transparent;\"\u003eAdmin user credentials\u003c/span\u003e\n\n\u003cp\u003eThis issue affects surelock windows: from 2.3.12 through 2.40.0.\u003c/p\u003e"
            }
          ],
          "value": "\nPlaintext Password in Registry\n\n vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve \n\nAdmin user credentials\n\nThis issue affects surelock windows: from 2.3.12 through 2.40.0.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-314",
              "description": "CWE-314: Cleartext Storage in the Registry",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-27T17:57:35.096Z",
        "orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
        "shortName": "42Gears"
      },
      "references": [
        {
          "url": "https://www.42gears.com/security-and-compliance/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Plaintext Password in Registry",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to \n2.41.0\n\n\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to \n2.41.0\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
    "assignerShortName": "42Gears",
    "cveId": "CVE-2023-2335",
    "datePublished": "2023-04-27T17:55:49.876Z",
    "dateReserved": "2023-04-27T09:46:47.715Z",
    "dateUpdated": "2025-01-30T20:54:42.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2331 (GCVE-0-2023-2331)

Vulnerability from cvelistv5 – Published: 2023-04-27 11:51 – Updated: 2025-01-30 21:00
VLAI?
Summary
Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service. This issue affects Surelock Windows : from 2.3.12 through 2.40.0.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-428 - Unquoted Search Path or Element
Assigner
References
Impacted products
Vendor Product Version
42Gears Surelock Windows Affected: 2.3.12 , ≤ 2.40.0 (patch)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:19:14.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.42gears.com/security-and-compliance"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2331",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T21:00:48.147460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-30T21:00:57.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://mars.42gears.com/support/inout/surelockwinsetupv2.40.0.exe",
          "defaultStatus": "unaffected",
          "packageName": "SureLock Service (NixService.exe)",
          "platforms": [
            "Windows"
          ],
          "product": "Surelock  Windows ",
          "vendor": "42Gears",
          "versions": [
            {
              "lessThanOrEqual": "2.40.0",
              "status": "affected",
              "version": "2.3.12",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.\u003cbr\u003e\u003cp\u003eThis issue affects Surelock Windows : from 2.3.12 through 2.40.0.\u003c/p\u003e"
            }
          ],
          "value": "Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.\nThis issue affects Surelock Windows : from 2.3.12 through 2.40.0.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-549",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-549 Local Execution of Code"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "CWE-428 Unquoted Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-28T07:16:21.298Z",
        "orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
        "shortName": "42Gears"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.42gears.com/security-and-compliance"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003eUpgrade to\u003c/b\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cb\u003e\u0026nbsp;SureLock windows agent version 2.41.0\u003c/b\u003e\u003c/span\u003e \n\n"
            }
          ],
          "value": "Upgrade to\u00a0SureLock windows agent version 2.41.0 \n\n"
        }
      ],
      "source": {
        "advisory": "01",
        "discovery": "EXTERNAL"
      },
      "title": "Bypassing hardening via Unquoted Service path vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
    "assignerShortName": "42Gears",
    "cveId": "CVE-2023-2331",
    "datePublished": "2023-04-27T11:51:45.946Z",
    "dateReserved": "2023-04-27T09:20:29.336Z",
    "dateUpdated": "2025-01-30T21:00:57.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}