An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration.
References
| Link | Resource |
|---|---|
| https://ysoft.com | Product |
| https://www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerability | Vendor Advisory |
Configurations
History
07 Nov 2023, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration. |
25 Jul 2023, 18:55
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (MISC) https://www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerability - Vendor Advisory | |
| References | (MISC) https://ysoft.com - Product | |
| First Time |
Ysoft safeq Server
Ysoft |
|
| CPE | cpe:2.3:h:ysoft:safeq_server:*:*:*:*:*:*:*:* | |
| CWE | CWE-319 |
13 Jul 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-13 17:15
Updated : 2024-08-02 17:15
NVD link : CVE-2023-35833
Mitre link : CVE-2023-35833
JSON object : View
Products Affected
ysoft
- safeq_server
CWE
CWE-319
Cleartext Transmission of Sensitive Information