Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
References
| Link | Resource |
|---|---|
| https://securenvoy.com/support/ | Product |
| https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393 | Exploit Third Party Advisory |
| https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22 | Exploit |
Configurations
History
12 Jun 2024, 17:56
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:securenvoy:multi-factor_authentication_solutions:*:*:*:*:*:*:*:* | |
| First Time |
Securenvoy multi-factor Authentication Solutions
Securenvoy |
|
| CWE | CWE-319 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22 - Exploit | |
| References | () https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393 - Exploit, Third Party Advisory | |
| References | () https://securenvoy.com/support/ - Product |
10 Jun 2024, 20:54
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-10 20:15
Updated : 2024-07-03 02:04
NVD link : CVE-2024-37393
Mitre link : CVE-2024-37393
JSON object : View
Products Affected
securenvoy
- multi-factor_authentication_solutions
CWE
CWE-319
Cleartext Transmission of Sensitive Information