CVE-2023-48427CWE-295

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2)

High · published December 12, 2023

CVSS v3.1
8.1
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses, potentially allowing an attacker to escalate privileges.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2023-12-12T11:27Z
EPSS history
Timeline
  • 12 DEC 11:27Z
    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2)
    cvelistv5