CVE-2023-28345

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28345
An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.

4.6 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://research.nccgroup.com/?research=Technical%20advisories Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories Third Party Advisory
https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ Exploit Mitigation Release Notes Third Party Advisory
https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ Exploit Mitigation Release Notes Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

14 Jan 2025, 15:15

Type Values Removed Values Added
References (MISC) https://research.nccgroup.com/?research=Technical%20advisories - Third Party Advisory () https://research.nccgroup.com/?research=Technical%20advisories - Third Party Advisory
References (MISC) https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ - Exploit, Mitigation, Release Notes, Third Party Advisory () https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ - Exploit, Mitigation, Release Notes, Third Party Advisory

06 Jun 2023, 18:31

Type Values Removed Values Added
CPE cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:*
First Time Faronics insight
Microsoft
Microsoft windows
Faronics
CWE CWE-312
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.6
References (MISC) https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ - (MISC) https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/ - Exploit, Mitigation, Release Notes, Third Party Advisory
References (MISC) https://research.nccgroup.com/?research=Technical%20advisories - (MISC) https://research.nccgroup.com/?research=Technical%20advisories - Third Party Advisory

31 May 2023, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-31 00:15

Updated : 2025-01-14 15:15

NVD link : CVE-2023-28345

Mitre link : CVE-2023-28345

JSON object : View

Products Affected

faronics

  • insight

microsoft

  • windows
CWE
CWE-312

Cleartext Storage of Sensitive Information