CVE-2023-4588: File accessibility vulnerability in Delinea Secret Server

Published Sep 6, 2023

Updated

File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.

Affected Software

2 affected components

Delinea Secret Server=10.9.000002

Delinea Secret Server=11.4.000002

Event History

Sep 6, 2023

CVE Published

via MITRE·11:43 AM

Data Sourced

via MITRE·11:43 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-4588?

CVE-2023-4588 is considered a high-severity vulnerability that affects authenticated users with administrative privileges.

How do I fix CVE-2023-4588?

To fix CVE-2023-4588, upgrade to Delinea Secret Server versions later than 10.9.000002 and 11.4.000002, which contain the necessary security patches.

Who is affected by CVE-2023-4588?

CVE-2023-4588 affects users running Delinea Secret Server versions 10.9.000002 and 11.4.000002.

What type of vulnerability is CVE-2023-4588?

CVE-2023-4588 is a file accessibility vulnerability that allows file creation in the webroot directory under certain conditions.

Can CVE-2023-4588 be exploited remotely?

CVE-2023-4588 requires authenticated access, meaning that only users with administrative privileges can exploit this vulnerability.