« Volver al listado

CVE-2023-0392

Estado: ModificadaMedia (6.7)—

The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Okta — Ldap Agent

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-0392",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0392",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-04T16:02:43.869848Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.9,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 0.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@okta.com",
      "affectedData": [
        {
          "vendor": "Okta",
          "product": "LDAP Agent",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:okta:ldap_agent:*:*:*:*:*:*:*:*"
          ],
          "vendor": "okta",
          "product": "ldap_agent",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-11-08T21:15:08.353",
  "references": [
    {
      "url": "https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@okta.com"
    },
    {
      "url": "https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@okta.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-428"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-428"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-428"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "El servicio LDAP Agent Update con versiones anteriores a la 5.18 utilizaba una ruta sin comillas, lo que podía permitir la ejecución de código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T05:25:26.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:okta:ldap_agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46817F73-3816-44BE-9F93-37236FF534B6",
              "versionEndExcluding": "5.18"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@okta.com"
}