« Volver al listado

CVE-2023-23951

Estado: ModificadaMedia (6.1)—

Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Broadcom — Symantec Identity Governance AND AdministrationBroadcom — Symantec Identity Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-23951",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-23951",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-02T14:33:15.803188Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@symantec.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Symantec Identity Management And Governance",
          "versions": [
            {
              "status": "affected",
              "version": "14.3, 14.4.1, 14.4.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-26T21:18:15.460",
  "references": [
    {
      "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/21174",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/21174",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application"
    },
    {
      "lang": "es",
      "value": "Capacidad de enumerar los atributos LDAP de Oracle para el usuario actual modificando la consulta utilizada por la aplicación."
    }
  ],
  "lastModified": "2026-06-17T05:38:21.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F02FD4DC-D8DF-4665-A0FC-0B62FA66939E"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23689A8F-BF69-411B-93C1-584E3251B55E"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAE61084-5A83-466E-96CA-46E84645AC2B"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_identity_manager:14.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25ABF24A-6352-469C-928E-67A4BEDB579C"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_identity_manager:14.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF8B308A-3E78-4E0D-9148-91B39BAF8845"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@symantec.com"
}