CVE-2023-33254: Medium severity Quest Kace Systems Deployment Appliance vulnerability
There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain. To exploit this, an authenticated attacker edits the user-authentication settings to specify an attacker-controlled LDAP server, clicks the Test Settings button, and captures the cleartext credentials.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-33254.
What is the severity of CVE-2023-33254?
The severity of CVE-2023-33254 is medium with a score of 6.5.
What is the affected software of CVE-2023-33254?
The affected software of CVE-2023-33254 is Quest KACE Systems Deployment Appliance version 9.0.146.
How can an attacker exploit CVE-2023-33254?
An authenticated attacker can exploit CVE-2023-33254 by editing the user-authentication settings to specify an attack.
Is there a fix available for CVE-2023-33254?
Yes, a fix is available for CVE-2023-33254. Please refer to the provided reference link for more details.