CVE-2023-35833

An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82

published July 13, 2023

CVSS
—
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.4th percentile
Published
2023-07-13T00:00Z
EPSS history
Timeline
  • 13 JUL 00:00Z
    An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82
    cvelistv5